Re: [PATCH] 9p: do not store the create fid on special files

[Dominique Martinet]

Yuanfu Xie wrote on Tue, Sep 22, 2026 at 09:16:22PM +0800:
> v9fs_vfs_atomic_open_dotl() always stores the create fid in
> file->private_data after finish_open().  FIFO and device inodes
> already have type-specific file_operations that own that field.
> Overwriting it with the fid makes later read/write/close treat the
> p9_fid as a pipe_inode_info, which corrupts the fid and can use it
> after it has been clunked.  The non-dotl atomic_open path does not
> assign the fid this way.
> 
> Only attach the fid for regular files and directories.  Special
> files do not need the create fid; leave it for the existing
> p9_fid_put() on the out path so it is clunked before return.
> 
> KASAN report, linux-stable 4982d3552a3b:
> 
> BUG: KASAN: slab-use-after-free in anon_pipe_prefill_and_lock+0x376/0x3f0
> Read of size 4 at addr ffff88800ab30538 by task repro/1
> 
> Call Trace:
>  <TASK>
>  anon_pipe_prefill_and_lock+0x376/0x3f0
>  anon_pipe_write+0x127/0x1600
>  fifo_pipe_write+0x24/0x300
>  vfs_write+0x659/0xd00
>  ksys_write+0x10f/0x200
>  do_syscall_64+0xdd/0x4a0
>  </TASK>
> 
> Fixes: 30d904947459 ("kill struct opendata")
> Signed-off-by: Yuanfu Xie <yuanfuxie@xxxxxxxxxxxxxx>

Thanks, also picked up

-- 
Dominique Martinet | Asmadeus