6.12-stable patches

added patches:
	fs-netfs-read_collect-add-to-next-prev_donated.patch

diff --git a/queue-6.12/fs-netfs-read_collect-add-to-next-prev_donated.patch b/queue-6.12/fs-netfs-read_collect-add-to-next-prev_donated.patch
new file mode 100644 (file)
index 0000000..4b57bbc
--- /dev/null
+++ b/queue-6.12/fs-netfs-read_collect-add-to-next-prev_donated.patch
@@ -0,0 +1,41 @@
+From stable+bounces-118455-greg=kroah.com@vger.kernel.org Thu Feb 20 07:27:34 2025
+From: Max Kellermann <max.kellermann@ionos.com>
+Date: Thu, 20 Feb 2025 16:24:50 +0100
+Subject: fs/netfs/read_collect: add to next->prev_donated
+To: dhowells@redhat.com, netfs@lists.linux.dev, linux-kernel@vger.kernel.org
+Cc: Max Kellermann <max.kellermann@ionos.com>, stable@vger.kernel.org
+Message-ID: <20250220152450.1075727-1-max.kellermann@ionos.com>
+
+From: Max Kellermann <max.kellermann@ionos.com>
+
+If multiple subrequests donate data to the same "next" request
+(depending on the subrequest completion order), each of them would
+overwrite the `prev_donated` field, causing data corruption and a
+BUG() crash ("Can't donate prior to front").
+
+Fixes: ee4cdf7ba857 ("netfs: Speed up buffered reading")
+Closes: https://lore.kernel.org/netfs/CAKPOu+_4mUwYgQtRTbXCmi+-k3PGvLysnPadkmHOyB7Gz0iSMA@mail.gmail.com/
+Cc: stable@vger.kernel.org
+Signed-off-by: Max Kellermann <max.kellermann@ionos.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/netfs/read_collect.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/netfs/read_collect.c b/fs/netfs/read_collect.c
+index 8878b46589ff..cafadfe8e858 100644
+--- a/fs/netfs/read_collect.c
++++ b/fs/netfs/read_collect.c
+@@ -284,7 +284,7 @@ static bool netfs_consume_read_data(struct netfs_io_subrequest *subreq, bool was
+                                  netfs_trace_donate_to_deferred_next);
+       } else {
+               next = list_next_entry(subreq, rreq_link);
+-              WRITE_ONCE(next->prev_donated, excess);
++              WRITE_ONCE(next->prev_donated, next->prev_donated + excess);
+               trace_netfs_donate(rreq, subreq, next, excess,
+                                  netfs_trace_donate_to_next);
+       }
+-- 
+2.47.2
+

diff --git a/queue-6.12/series b/queue-6.12/series
index 56cbc42933e71d4d2b649bbcf0c68402f8507eff..fcecd0950c6df46d1aa8551aebec2ef96ac890bb 100644 (file)
--- a/queue-6.12/series
+++ b/queue-6.12/series
@@ -228,3 +228,4 @@ tools-sched_ext-add-helper-to-check-task-migration-state.patch
 bluetooth-l2cap-fix-corrupted-list-in-hci_chan_del.patch
 nvme-fc-rely-on-state-transitions-to-handle-connectivity-loss.patch
 hid-apple-disable-fn-key-handling-on-the-omoton-kb066.patch
+fs-netfs-read_collect-add-to-next-prev_donated.patch