p9_client_flush() finds the tag of the request to cancel by parsing the header of oldreq->tc. For a zero-copy TWRITE, however, p9_virtio_zc_request() adds the payload length to the size in the header after marshalling, so p9_parse_header() fails on the mismatch with tc.size and no TFLUSH is sent. As a result, a zero-copy write interrupted by a fatal signal returns without waiting for the RFLUSH, and the server can still write the data after the writer is killed, overwriting a later write to the same file. Use the tag in oldreq->tc.tag and drop the parse, so a TFLUSH is sent. This patch is assisted by Claude Opus 5.5. Fixes: d28c756caee6 ("9p/net: Fix zero-copy path in the 9p virtio transport") Cc: stable@vger.kernel.org Signed-off-by: Lianjie Wang --- net/9p/client.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/net/9p/client.c b/net/9p/client.c index 66980ad52bca8..15bb939087165 100644 --- a/net/9p/client.c +++ b/net/9p/client.c @@ -477,12 +477,7 @@ p9_client_rpc(struct p9_client *c, int8_t type, const char *fmt, ...); static int p9_client_flush(struct p9_client *c, struct p9_req_t *oldreq) { struct p9_req_t *req; - s16 oldtag; - int err; - - err = p9_parse_header(&oldreq->tc, NULL, NULL, &oldtag, 1); - if (err) - return err; + s16 oldtag = oldreq->tc.tag; p9_debug(P9_DEBUG_9P, ">>> TFLUSH tag %d\n", oldtag); -- 2.56.0