[BUG] 9p: unknown RLOCK status triggers WARN_ONCE panic with panic_on_warn

Yifei Chu <[email protected]> Sun, 24 May 2026 10:43:57 -0400
Newsgroups dev.linux.lists.v9fs,org.kernel.vger.linux-kernel
Message-ID <CAPJnbgJ7ZK7DCjCfG56hd_iKGePmAzudb4hOWd4=9r32nM+KcA@mail.gmail.com>
Hello,

Short version: I found that a 9P2000.L server can return an unknown RLOCK
status byte and make the Linux 9P client hit a WARN_ONCE() in
v9fs_file_do_lock(). With panic_on_warn=1, that turns into a reproducible
kernel panic.

The reproducer is small: it starts a minimal fd-transport 9P2000.L server,
mounts it, opens a file, and calls fcntl(F_SETLK). The server replies to
TLOCK with:

RLOCK status = 0xff

That server-controlled value reaches this path in the client:

WARN_ONCE(1, “unknown lock status code: %d\n”, status);

Tested environment:

Linux version 7.0.9, x86_64 QEMU
gcc 12.3.0, GNU ld 2.38
Boot args included: panic_on_warn=1 nokaslr console=ttyS0

The panic I see is:

unknown lock status code: 255
WARNING: fs/9p/vfs_file.c:201 at v9fs_file_do_lock+0x614/0x730
Kernel panic - not syncing: kernel: panic_on_warn set …

I also checked current mainline source and still see the WARN_ONCE path in
fs/9p/vfs_file.c. I have reproduced the panic on the 7.0.9 QEMU build
above; I have not yet runtime-tested current mainline.

My read is that an unknown status from a protocol peer should probably be
handled as a protocol/locking error instead of reaching WARN_ONCE().
Returning something like -EPROTO or -ENOLCK, with a non-WARN diagnostic if
useful, seems safer.

The attached tarball has the README, C reproducer, and full QEMU log.

Thanks,
Chuyifei
9p_lock_unknown_status_warn_panic.tar.gz (application/x-tar, 14 KB) - not displayed