On Fri, Oct 09, 2026 at 10:07:58PM +0000, [email protected] wrote: > Does this regression introduce a TOCTOU race in afs_atcell_get_link() that > can cause a NULL dereference? > > By leaving put_net() executing before the RCU grace period, afs_net_exit() can > tear down the namespace while pathwalks are still active. If cleanup_net() > calls afs_cell_purge(), it replaces net->ws_cell with NULL.
No. This patch doesn't touch put_net(). It's called in the same place as before. The only place that sets net->ws_cell to NULL is afs_cell_purge() from afs_net_exit(). The superblock pins the network namespace via as->net_ns and once the last reference is gone cleanup_net() does a synchronize_rcu() before it calls any ->exit() method. So afs_cell_purge() can't run while a pathwalk is still in afs_atcell_get_link() in rcu mode. The double load of net->ws_cell is a bit sloppy but it's harmless. > Can net->ws_cell be cleared to NULL before the lock is acquired, causing a > NULL dereference here as well? No. Without rcu the caller holds references to the dentry and the mount. So the superblock and with it the network namespace can't go away underneath it.
