Re: [PATCH 2/8] afs: free the super info after a grace period

On Fri, Oct 09, 2026 at 10:07:58PM +0000, sashiko-bot@kernel.org wrote:

Does this regression introduce a TOCTOU race in afs_atcell_get_link() that
can cause a NULL dereference?

By leaving put_net() executing before the RCU grace period, afs_net_exit() can
tear down the namespace while pathwalks are still active. If cleanup_net()
calls afs_cell_purge(), it replaces net->ws_cell with NULL.

No. This patch doesn't touch put_net(). It's called in the same place
as before.

The only place that sets net->ws_cell to NULL is afs_cell_purge() from
afs_net_exit(). The superblock pins the network namespace via
as->net_ns and once the last reference is gone cleanup_net() does a
synchronize_rcu() before it calls any ->exit() method. So
afs_cell_purge() can't run while a pathwalk is still in
afs_atcell_get_link() in rcu mode.

The double load of net->ws_cell is a bit sloppy but it's harmless.

Can net->ws_cell be cleared to NULL before the lock is acquired, causing a
NULL dereference here as well?

No. Without rcu the caller holds references to the dentry and the
mount. So the superblock and with it the network namespace can't go
away underneath it.