From: Sasha Levin Date: Sun, 15 Jun 2025 22:47:44 +0000 (-0400) Subject: Fixes for 6.12 X-Git-Tag: v6.6.94~57 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=477a43dde16030d6939ed266edaff5cf0f4e9248;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.12 Signed-off-by: Sasha Levin --- diff --git a/queue-6.12/bio-fix-bio_first_folio-for-sparsemem-without-vmemma.patch b/queue-6.12/bio-fix-bio_first_folio-for-sparsemem-without-vmemma.patch new file mode 100644 index 0000000000..d6e2e4cf31 --- /dev/null +++ b/queue-6.12/bio-fix-bio_first_folio-for-sparsemem-without-vmemma.patch @@ -0,0 +1,39 @@ +From 3ef47662318d1ba8c89a40b13070646d8bb1275f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Jun 2025 15:41:25 +0100 +Subject: bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP + +From: Matthew Wilcox (Oracle) + +[ Upstream commit f826ec7966a63d48e16e0868af4e038bf9a1a3ae ] + +It is possible for physically contiguous folios to have discontiguous +struct pages if SPARSEMEM is enabled and SPARSEMEM_VMEMMAP is not. +This is correctly handled by folio_page_idx(), so remove this open-coded +implementation. + +Fixes: 640d1930bef4 (block: Add bio_for_each_folio_all()) +Signed-off-by: Matthew Wilcox (Oracle) +Link: https://lore.kernel.org/r/20250612144126.2849931-1-willy@infradead.org +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + include/linux/bio.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/bio.h b/include/linux/bio.h +index 9e98fb87e7ef7..1289b8e487801 100644 +--- a/include/linux/bio.h ++++ b/include/linux/bio.h +@@ -294,7 +294,7 @@ static inline void bio_first_folio(struct folio_iter *fi, struct bio *bio, + + fi->folio = page_folio(bvec->bv_page); + fi->offset = bvec->bv_offset + +- PAGE_SIZE * (bvec->bv_page - &fi->folio->page); ++ PAGE_SIZE * folio_page_idx(fi->folio, bvec->bv_page); + fi->_seg_count = bvec->bv_len; + fi->length = min(folio_size(fi->folio) - fi->offset, fi->_seg_count); + fi->_next = folio_next(fi->folio); +-- +2.39.5 + diff --git a/queue-6.12/block-don-t-use-submit_bio_noacct_nocheck-in-blk_zon.patch b/queue-6.12/block-don-t-use-submit_bio_noacct_nocheck-in-blk_zon.patch new file mode 100644 index 0000000000..8c398baec5 --- /dev/null +++ b/queue-6.12/block-don-t-use-submit_bio_noacct_nocheck-in-blk_zon.patch @@ -0,0 +1,61 @@ +From ff36dbb907ca38150ea87126f408fa0ba00ca24b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Jun 2025 06:44:16 +0200 +Subject: block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work + +From: Christoph Hellwig + +[ Upstream commit cf625013d8741c01407bbb4a60c111b61b9fa69d ] + +Bios queued up in the zone write plug have already gone through all all +preparation in the submit_bio path, including the freeze protection. + +Submitting them through submit_bio_noacct_nocheck duplicates the work +and can can cause deadlocks when freezing a queue with pending bio +write plugs. + +Go straight to ->submit_bio or blk_mq_submit_bio to bypass the +superfluous extra freeze protection and checks. + +Fixes: 9b1ce7f0c6f8 ("block: Implement zone append emulation") +Reported-by: Bart Van Assche +Signed-off-by: Christoph Hellwig +Reviewed-by: Johannes Thumshirn +Reviewed-by: Damien Le Moal +Tested-by: Damien Le Moal +Link: https://lore.kernel.org/r/20250611044416.2351850-1-hch@lst.de +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-zoned.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/block/blk-zoned.c b/block/blk-zoned.c +index 414118435240a..164ded9eb1444 100644 +--- a/block/blk-zoned.c ++++ b/block/blk-zoned.c +@@ -1321,7 +1321,6 @@ static void blk_zone_wplug_bio_work(struct work_struct *work) + spin_unlock_irqrestore(&zwplug->lock, flags); + + bdev = bio->bi_bdev; +- submit_bio_noacct_nocheck(bio); + + /* + * blk-mq devices will reuse the extra reference on the request queue +@@ -1329,8 +1328,12 @@ static void blk_zone_wplug_bio_work(struct work_struct *work) + * path for BIO-based devices will not do that. So drop this extra + * reference here. + */ +- if (bdev_test_flag(bdev, BD_HAS_SUBMIT_BIO)) ++ if (bdev_test_flag(bdev, BD_HAS_SUBMIT_BIO)) { ++ bdev->bd_disk->fops->submit_bio(bio); + blk_queue_exit(bdev->bd_disk->queue); ++ } else { ++ blk_mq_submit_bio(bio); ++ } + + put_zwplug: + /* Drop the reference we took in disk_zone_wplug_schedule_bio_work(). */ +-- +2.39.5 + diff --git a/queue-6.12/block-fix-bvec_set_folio-for-very-large-folios.patch b/queue-6.12/block-fix-bvec_set_folio-for-very-large-folios.patch new file mode 100644 index 0000000000..2f6b40fddf --- /dev/null +++ b/queue-6.12/block-fix-bvec_set_folio-for-very-large-folios.patch @@ -0,0 +1,46 @@ +From 3dad6375db235f6e42d5de7948a8c40051f32892 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Jun 2025 15:42:53 +0100 +Subject: block: Fix bvec_set_folio() for very large folios + +From: Matthew Wilcox (Oracle) + +[ Upstream commit 5e223e06ee7c6d8f630041a0645ac90e39a42cc6 ] + +Similarly to 26064d3e2b4d ("block: fix adding folio to bio"), if +we attempt to add a folio that is larger than 4GB, we'll silently +truncate the offset and len. Widen the parameters to size_t, assert +that the length is less than 4GB and set the first page that contains +the interesting data rather than the first page of the folio. + +Fixes: 26db5ee15851 (block: add a bvec_set_folio helper) +Signed-off-by: Matthew Wilcox (Oracle) +Link: https://lore.kernel.org/r/20250612144255.2850278-1-willy@infradead.org +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + include/linux/bvec.h | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/include/linux/bvec.h b/include/linux/bvec.h +index f41c7f0ef91ed..a8333b82e766d 100644 +--- a/include/linux/bvec.h ++++ b/include/linux/bvec.h +@@ -57,9 +57,12 @@ static inline void bvec_set_page(struct bio_vec *bv, struct page *page, + * @offset: offset into the folio + */ + static inline void bvec_set_folio(struct bio_vec *bv, struct folio *folio, +- unsigned int len, unsigned int offset) ++ size_t len, size_t offset) + { +- bvec_set_page(bv, &folio->page, len, offset); ++ unsigned long nr = offset / PAGE_SIZE; ++ ++ WARN_ON_ONCE(len > UINT_MAX); ++ bvec_set_page(bv, folio_page(folio, nr), len, offset % PAGE_SIZE); + } + + /** +-- +2.39.5 + diff --git a/queue-6.12/block-use-q-elevator-with-elevator_lock-held-in-elv_.patch b/queue-6.12/block-use-q-elevator-with-elevator_lock-held-in-elv_.patch new file mode 100644 index 0000000000..624d76ace6 --- /dev/null +++ b/queue-6.12/block-use-q-elevator-with-elevator_lock-held-in-elv_.patch @@ -0,0 +1,49 @@ +From 3119b3819cc70e7c2aeddf6addeaa1a40c22ddd6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 May 2025 22:17:42 +0800 +Subject: block: use q->elevator with ->elevator_lock held in + elv_iosched_show() + +From: Ming Lei + +[ Upstream commit 94209d27d14104ed828ca88cd5403a99162fe51a ] + +Use q->elevator with ->elevator_lock held in elv_iosched_show(), since +the local cached elevator reference may become stale after getting +->elevator_lock. + +Reviewed-by: Hannes Reinecke +Reviewed-by: Nilay Shroff +Reviewed-by: Christoph Hellwig +Signed-off-by: Ming Lei +Link: https://lore.kernel.org/r/20250505141805.2751237-5-ming.lei@redhat.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/elevator.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/block/elevator.c b/block/elevator.c +index 43ba4ab1ada7f..1f76e9efd7717 100644 +--- a/block/elevator.c ++++ b/block/elevator.c +@@ -752,7 +752,6 @@ ssize_t elv_iosched_store(struct gendisk *disk, const char *buf, + ssize_t elv_iosched_show(struct gendisk *disk, char *name) + { + struct request_queue *q = disk->queue; +- struct elevator_queue *eq = q->elevator; + struct elevator_type *cur = NULL, *e; + int len = 0; + +@@ -763,7 +762,7 @@ ssize_t elv_iosched_show(struct gendisk *disk, char *name) + len += sprintf(name+len, "[none] "); + } else { + len += sprintf(name+len, "none "); +- cur = eq->type; ++ cur = q->elevator->type; + } + + spin_lock(&elv_list_lock); +-- +2.39.5 + diff --git a/queue-6.12/btrfs-exit-after-state-insertion-failure-at-btrfs_co.patch b/queue-6.12/btrfs-exit-after-state-insertion-failure-at-btrfs_co.patch new file mode 100644 index 0000000000..118b5bb861 --- /dev/null +++ b/queue-6.12/btrfs-exit-after-state-insertion-failure-at-btrfs_co.patch @@ -0,0 +1,43 @@ +From f57e05b30f48761ef99927811b86e99c30537145 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Apr 2025 17:11:14 +0100 +Subject: btrfs: exit after state insertion failure at + btrfs_convert_extent_bit() + +From: Filipe Manana + +[ Upstream commit 3bf179e36da917c5d9bec71c714573ed1649b7c1 ] + +If insert_state() state failed it returns an error pointer and we call +extent_io_tree_panic() which will trigger a BUG() call. However if +CONFIG_BUG is disabled, which is an uncommon and exotic scenario, then +we fallthrough and call cache_state() which will dereference the error +pointer, resulting in an invalid memory access. + +So jump to the 'out' label after calling extent_io_tree_panic(), it also +makes the code more clear besides dealing with the exotic scenario where +CONFIG_BUG is disabled. + +Signed-off-by: Filipe Manana +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/extent-io-tree.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/btrfs/extent-io-tree.c b/fs/btrfs/extent-io-tree.c +index 6d08c100b01de..bb3aaf610652a 100644 +--- a/fs/btrfs/extent-io-tree.c ++++ b/fs/btrfs/extent-io-tree.c +@@ -1456,6 +1456,7 @@ int convert_extent_bit(struct extent_io_tree *tree, u64 start, u64 end, + if (IS_ERR(inserted_state)) { + ret = PTR_ERR(inserted_state); + extent_io_tree_panic(tree, prealloc, "insert", ret); ++ goto out; + } + cache_state(inserted_state, cached_state); + if (inserted_state == prealloc) +-- +2.39.5 + diff --git a/queue-6.12/btrfs-exit-after-state-split-error-at-set_extent_bit.patch b/queue-6.12/btrfs-exit-after-state-split-error-at-set_extent_bit.patch new file mode 100644 index 0000000000..d84aac6c09 --- /dev/null +++ b/queue-6.12/btrfs-exit-after-state-split-error-at-set_extent_bit.patch @@ -0,0 +1,47 @@ +From ae1353d887d640c4b2b4bb923dac6389d74c1c1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Apr 2025 16:00:28 +0100 +Subject: btrfs: exit after state split error at set_extent_bit() + +From: Filipe Manana + +[ Upstream commit 41d69d4d78d8b179bf3bcdfc56d28a12b3a608d2 ] + +If split_state() returned an error we call extent_io_tree_panic() which +will trigger a BUG() call. However if CONFIG_BUG is disabled, which is an +uncommon and exotic scenario, then we fallthrough and hit a use after free +when calling set_state_bits() since the extent state record which the +local variable 'prealloc' points to was freed by split_state(). + +So jump to the label 'out' after calling extent_io_tree_panic() and set +the 'prealloc' pointer to NULL since split_state() has already freed it +when it hit an error. + +Signed-off-by: Filipe Manana +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/extent-io-tree.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/btrfs/extent-io-tree.c b/fs/btrfs/extent-io-tree.c +index bb3aaf610652a..5f9a43734812e 100644 +--- a/fs/btrfs/extent-io-tree.c ++++ b/fs/btrfs/extent-io-tree.c +@@ -1252,8 +1252,11 @@ static int __set_extent_bit(struct extent_io_tree *tree, u64 start, u64 end, + if (!prealloc) + goto search_again; + ret = split_state(tree, state, prealloc, end + 1); +- if (ret) ++ if (ret) { + extent_io_tree_panic(tree, state, "split", ret); ++ prealloc = NULL; ++ goto out; ++ } + + set_state_bits(tree, prealloc, bits, changeset); + cache_state(prealloc, cached_state); +-- +2.39.5 + diff --git a/queue-6.12/fs-filesystems-fix-potential-unsigned-integer-underf.patch b/queue-6.12/fs-filesystems-fix-potential-unsigned-integer-underf.patch new file mode 100644 index 0000000000..225ce47684 --- /dev/null +++ b/queue-6.12/fs-filesystems-fix-potential-unsigned-integer-underf.patch @@ -0,0 +1,55 @@ +From f37b1a22918f54e250f93cb950dab58ae9830091 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Apr 2025 19:45:27 +0800 +Subject: fs/filesystems: Fix potential unsigned integer underflow in fs_name() + +From: Zijun Hu + +[ Upstream commit 1363c134ade81e425873b410566e957fecebb261 ] + +fs_name() has @index as unsigned int, so there is underflow risk for +operation '@index--'. + +Fix by breaking the for loop when '@index == 0' which is also more proper +than '@index <= 0' for unsigned integer comparison. + +Signed-off-by: Zijun Hu +Link: https://lore.kernel.org/20250410-fix_fs-v1-1-7c14ccc8ebaa@quicinc.com +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/filesystems.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +diff --git a/fs/filesystems.c b/fs/filesystems.c +index 58b9067b2391c..95e5256821a53 100644 +--- a/fs/filesystems.c ++++ b/fs/filesystems.c +@@ -156,15 +156,19 @@ static int fs_index(const char __user * __name) + static int fs_name(unsigned int index, char __user * buf) + { + struct file_system_type * tmp; +- int len, res; ++ int len, res = -EINVAL; + + read_lock(&file_systems_lock); +- for (tmp = file_systems; tmp; tmp = tmp->next, index--) +- if (index <= 0 && try_module_get(tmp->owner)) ++ for (tmp = file_systems; tmp; tmp = tmp->next, index--) { ++ if (index == 0) { ++ if (try_module_get(tmp->owner)) ++ res = 0; + break; ++ } ++ } + read_unlock(&file_systems_lock); +- if (!tmp) +- return -EINVAL; ++ if (res) ++ return res; + + /* OK, we got the reference, so we can safely block */ + len = strlen(tmp->name) + 1; +-- +2.39.5 + diff --git a/queue-6.12/gfs2-pass-through-holder-from-the-vfs-for-freeze-tha.patch b/queue-6.12/gfs2-pass-through-holder-from-the-vfs-for-freeze-tha.patch new file mode 100644 index 0000000000..f36e67d8c5 --- /dev/null +++ b/queue-6.12/gfs2-pass-through-holder-from-the-vfs-for-freeze-tha.patch @@ -0,0 +1,97 @@ +From 8ffecc9a886ebfaf33663eb63dab2baed047ba0b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Apr 2025 21:02:28 +0200 +Subject: gfs2: pass through holder from the VFS for freeze/thaw + +From: Christian Brauner + +[ Upstream commit 62a2175ddf7e72941868f164b7c1f92e00f213bd ] + +The filesystem's freeze/thaw functions can be called from contexts where +the holder isn't userspace but the kernel, e.g., during systemd +suspend/hibernate. So pass through the freeze/thaw flags from the VFS +instead of hard-coding them. + +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/gfs2/super.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c +index 6d62ff5cb445a..5ecb857cf74e3 100644 +--- a/fs/gfs2/super.c ++++ b/fs/gfs2/super.c +@@ -674,7 +674,7 @@ static int gfs2_sync_fs(struct super_block *sb, int wait) + return sdp->sd_log_error; + } + +-static int gfs2_do_thaw(struct gfs2_sbd *sdp) ++static int gfs2_do_thaw(struct gfs2_sbd *sdp, enum freeze_holder who) + { + struct super_block *sb = sdp->sd_vfs; + int error; +@@ -682,7 +682,7 @@ static int gfs2_do_thaw(struct gfs2_sbd *sdp) + error = gfs2_freeze_lock_shared(sdp); + if (error) + goto fail; +- error = thaw_super(sb, FREEZE_HOLDER_USERSPACE); ++ error = thaw_super(sb, who); + if (!error) + return 0; + +@@ -710,7 +710,7 @@ void gfs2_freeze_func(struct work_struct *work) + gfs2_freeze_unlock(sdp); + set_bit(SDF_FROZEN, &sdp->sd_flags); + +- error = gfs2_do_thaw(sdp); ++ error = gfs2_do_thaw(sdp, FREEZE_HOLDER_USERSPACE); + if (error) + goto out; + +@@ -728,6 +728,7 @@ void gfs2_freeze_func(struct work_struct *work) + /** + * gfs2_freeze_super - prevent further writes to the filesystem + * @sb: the VFS structure for the filesystem ++ * @who: freeze flags + * + */ + +@@ -744,7 +745,7 @@ static int gfs2_freeze_super(struct super_block *sb, enum freeze_holder who) + } + + for (;;) { +- error = freeze_super(sb, FREEZE_HOLDER_USERSPACE); ++ error = freeze_super(sb, who); + if (error) { + fs_info(sdp, "GFS2: couldn't freeze filesystem: %d\n", + error); +@@ -758,7 +759,7 @@ static int gfs2_freeze_super(struct super_block *sb, enum freeze_holder who) + break; + } + +- error = gfs2_do_thaw(sdp); ++ error = gfs2_do_thaw(sdp, who); + if (error) + goto out; + +@@ -796,6 +797,7 @@ static int gfs2_freeze_fs(struct super_block *sb) + /** + * gfs2_thaw_super - reallow writes to the filesystem + * @sb: the VFS structure for the filesystem ++ * @who: freeze flags + * + */ + +@@ -814,7 +816,7 @@ static int gfs2_thaw_super(struct super_block *sb, enum freeze_holder who) + atomic_inc(&sb->s_active); + gfs2_freeze_unlock(sdp); + +- error = gfs2_do_thaw(sdp); ++ error = gfs2_do_thaw(sdp, who); + + if (!error) { + clear_bit(SDF_FREEZE_INITIATOR, &sdp->sd_flags); +-- +2.39.5 + diff --git a/queue-6.12/io_uring-consistently-use-rcu-semantics-with-sqpoll-.patch b/queue-6.12/io_uring-consistently-use-rcu-semantics-with-sqpoll-.patch new file mode 100644 index 0000000000..58c8c7e209 --- /dev/null +++ b/queue-6.12/io_uring-consistently-use-rcu-semantics-with-sqpoll-.patch @@ -0,0 +1,183 @@ +From 88a6e1fa16c880a5441a9ffe080cadd373cc3f9c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Jun 2025 13:53:43 -0700 +Subject: io_uring: consistently use rcu semantics with sqpoll thread + +From: Keith Busch + +[ Upstream commit c538f400fae22725580842deb2bef546701b64bd ] + +The sqpoll thread is dereferenced with rcu read protection in one place, +so it needs to be annotated as an __rcu type, and should consistently +use rcu helpers for access and assignment to make sparse happy. + +Since most of the accesses occur under the sqd->lock, we can use +rcu_dereference_protected() without declaring an rcu read section. +Provide a simple helper to get the thread from a locked context. + +Fixes: ac0b8b327a5677d ("io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo()") +Signed-off-by: Keith Busch +Link: https://lore.kernel.org/r/20250611205343.1821117-1-kbusch@meta.com +[axboe: fold in fix for register.c] +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + io_uring/io_uring.c | 4 ++-- + io_uring/register.c | 7 +++++-- + io_uring/sqpoll.c | 34 ++++++++++++++++++++++++---------- + io_uring/sqpoll.h | 8 +++++++- + 4 files changed, 38 insertions(+), 15 deletions(-) + +diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c +index bd3b3f7a6f6ca..64870f51b6788 100644 +--- a/io_uring/io_uring.c ++++ b/io_uring/io_uring.c +@@ -2916,7 +2916,7 @@ static __cold void io_ring_exit_work(struct work_struct *work) + struct task_struct *tsk; + + io_sq_thread_park(sqd); +- tsk = sqd->thread; ++ tsk = sqpoll_task_locked(sqd); + if (tsk && tsk->io_uring && tsk->io_uring->io_wq) + io_wq_cancel_cb(tsk->io_uring->io_wq, + io_cancel_ctx_cb, ctx, true); +@@ -3153,7 +3153,7 @@ __cold void io_uring_cancel_generic(bool cancel_all, struct io_sq_data *sqd) + s64 inflight; + DEFINE_WAIT(wait); + +- WARN_ON_ONCE(sqd && sqd->thread != current); ++ WARN_ON_ONCE(sqd && sqpoll_task_locked(sqd) != current); + + if (!current->io_uring) + return; +diff --git a/io_uring/register.c b/io_uring/register.c +index eca26d4884d9a..a325b493ae121 100644 +--- a/io_uring/register.c ++++ b/io_uring/register.c +@@ -268,6 +268,8 @@ static __cold int io_register_iowq_max_workers(struct io_ring_ctx *ctx, + if (ctx->flags & IORING_SETUP_SQPOLL) { + sqd = ctx->sq_data; + if (sqd) { ++ struct task_struct *tsk; ++ + /* + * Observe the correct sqd->lock -> ctx->uring_lock + * ordering. Fine to drop uring_lock here, we hold +@@ -277,8 +279,9 @@ static __cold int io_register_iowq_max_workers(struct io_ring_ctx *ctx, + mutex_unlock(&ctx->uring_lock); + mutex_lock(&sqd->lock); + mutex_lock(&ctx->uring_lock); +- if (sqd->thread) +- tctx = sqd->thread->io_uring; ++ tsk = sqpoll_task_locked(sqd); ++ if (tsk) ++ tctx = tsk->io_uring; + } + } else { + tctx = current->io_uring; +diff --git a/io_uring/sqpoll.c b/io_uring/sqpoll.c +index b0f17a1220ecd..9a63068948957 100644 +--- a/io_uring/sqpoll.c ++++ b/io_uring/sqpoll.c +@@ -30,7 +30,7 @@ enum { + void io_sq_thread_unpark(struct io_sq_data *sqd) + __releases(&sqd->lock) + { +- WARN_ON_ONCE(sqd->thread == current); ++ WARN_ON_ONCE(sqpoll_task_locked(sqd) == current); + + /* + * Do the dance but not conditional clear_bit() because it'd race with +@@ -45,24 +45,32 @@ void io_sq_thread_unpark(struct io_sq_data *sqd) + void io_sq_thread_park(struct io_sq_data *sqd) + __acquires(&sqd->lock) + { +- WARN_ON_ONCE(data_race(sqd->thread) == current); ++ struct task_struct *tsk; + + atomic_inc(&sqd->park_pending); + set_bit(IO_SQ_THREAD_SHOULD_PARK, &sqd->state); + mutex_lock(&sqd->lock); +- if (sqd->thread) +- wake_up_process(sqd->thread); ++ ++ tsk = sqpoll_task_locked(sqd); ++ if (tsk) { ++ WARN_ON_ONCE(tsk == current); ++ wake_up_process(tsk); ++ } + } + + void io_sq_thread_stop(struct io_sq_data *sqd) + { +- WARN_ON_ONCE(sqd->thread == current); ++ struct task_struct *tsk; ++ + WARN_ON_ONCE(test_bit(IO_SQ_THREAD_SHOULD_STOP, &sqd->state)); + + set_bit(IO_SQ_THREAD_SHOULD_STOP, &sqd->state); + mutex_lock(&sqd->lock); +- if (sqd->thread) +- wake_up_process(sqd->thread); ++ tsk = sqpoll_task_locked(sqd); ++ if (tsk) { ++ WARN_ON_ONCE(tsk == current); ++ wake_up_process(tsk); ++ } + mutex_unlock(&sqd->lock); + wait_for_completion(&sqd->exited); + } +@@ -498,7 +506,10 @@ __cold int io_sq_offload_create(struct io_ring_ctx *ctx, + goto err_sqpoll; + } + +- sqd->thread = tsk; ++ mutex_lock(&sqd->lock); ++ rcu_assign_pointer(sqd->thread, tsk); ++ mutex_unlock(&sqd->lock); ++ + task_to_put = get_task_struct(tsk); + ret = io_uring_alloc_task_context(tsk, ctx); + wake_up_new_task(tsk); +@@ -526,10 +537,13 @@ __cold int io_sqpoll_wq_cpu_affinity(struct io_ring_ctx *ctx, + int ret = -EINVAL; + + if (sqd) { ++ struct task_struct *tsk; ++ + io_sq_thread_park(sqd); + /* Don't set affinity for a dying thread */ +- if (sqd->thread) +- ret = io_wq_cpu_affinity(sqd->thread->io_uring, mask); ++ tsk = sqpoll_task_locked(sqd); ++ if (tsk) ++ ret = io_wq_cpu_affinity(tsk->io_uring, mask); + io_sq_thread_unpark(sqd); + } + +diff --git a/io_uring/sqpoll.h b/io_uring/sqpoll.h +index 4171666b1cf4c..b83dcdec9765f 100644 +--- a/io_uring/sqpoll.h ++++ b/io_uring/sqpoll.h +@@ -8,7 +8,7 @@ struct io_sq_data { + /* ctx's that are using this sqd */ + struct list_head ctx_list; + +- struct task_struct *thread; ++ struct task_struct __rcu *thread; + struct wait_queue_head wait; + + unsigned sq_thread_idle; +@@ -29,3 +29,9 @@ void io_sq_thread_unpark(struct io_sq_data *sqd); + void io_put_sq_data(struct io_sq_data *sqd); + void io_sqpoll_wait_sq(struct io_ring_ctx *ctx); + int io_sqpoll_wq_cpu_affinity(struct io_ring_ctx *ctx, cpumask_var_t mask); ++ ++static inline struct task_struct *sqpoll_task_locked(struct io_sq_data *sqd) ++{ ++ return rcu_dereference_protected(sqd->thread, ++ lockdep_is_held(&sqd->lock)); ++} +-- +2.39.5 + diff --git a/queue-6.12/io_uring-fix-use-after-free-of-sq-thread-in-__io_uri.patch b/queue-6.12/io_uring-fix-use-after-free-of-sq-thread-in-__io_uri.patch new file mode 100644 index 0000000000..e732fcb6b6 --- /dev/null +++ b/queue-6.12/io_uring-fix-use-after-free-of-sq-thread-in-__io_uri.patch @@ -0,0 +1,208 @@ +From 532ab57a0a47d0b5d4d14b50d9ce70dca94228b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jun 2025 10:18:01 -0700 +Subject: io_uring: fix use-after-free of sq->thread in + __io_uring_show_fdinfo() + +From: Penglei Jiang + +[ Upstream commit ac0b8b327a5677dc6fecdf353d808161525b1ff0 ] + +syzbot reports: + +BUG: KASAN: slab-use-after-free in getrusage+0x1109/0x1a60 +Read of size 8 at addr ffff88810de2d2c8 by task a.out/304 + +CPU: 0 UID: 0 PID: 304 Comm: a.out Not tainted 6.16.0-rc1 #1 PREEMPT(voluntary) +Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 +Call Trace: + + dump_stack_lvl+0x53/0x70 + print_report+0xd0/0x670 + ? __pfx__raw_spin_lock_irqsave+0x10/0x10 + ? getrusage+0x1109/0x1a60 + kasan_report+0xce/0x100 + ? getrusage+0x1109/0x1a60 + getrusage+0x1109/0x1a60 + ? __pfx_getrusage+0x10/0x10 + __io_uring_show_fdinfo+0x9fe/0x1790 + ? ksys_read+0xf7/0x1c0 + ? do_syscall_64+0xa4/0x260 + ? vsnprintf+0x591/0x1100 + ? __pfx___io_uring_show_fdinfo+0x10/0x10 + ? __pfx_vsnprintf+0x10/0x10 + ? mutex_trylock+0xcf/0x130 + ? __pfx_mutex_trylock+0x10/0x10 + ? __pfx_show_fd_locks+0x10/0x10 + ? io_uring_show_fdinfo+0x57/0x80 + io_uring_show_fdinfo+0x57/0x80 + seq_show+0x38c/0x690 + seq_read_iter+0x3f7/0x1180 + ? inode_set_ctime_current+0x160/0x4b0 + seq_read+0x271/0x3e0 + ? __pfx_seq_read+0x10/0x10 + ? __pfx__raw_spin_lock+0x10/0x10 + ? __mark_inode_dirty+0x402/0x810 + ? selinux_file_permission+0x368/0x500 + ? file_update_time+0x10f/0x160 + vfs_read+0x177/0xa40 + ? __pfx___handle_mm_fault+0x10/0x10 + ? __pfx_vfs_read+0x10/0x10 + ? mutex_lock+0x81/0xe0 + ? __pfx_mutex_lock+0x10/0x10 + ? fdget_pos+0x24d/0x4b0 + ksys_read+0xf7/0x1c0 + ? __pfx_ksys_read+0x10/0x10 + ? do_user_addr_fault+0x43b/0x9c0 + do_syscall_64+0xa4/0x260 + entry_SYSCALL_64_after_hwframe+0x77/0x7f +RIP: 0033:0x7f0f74170fc9 +Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 8 +RSP: 002b:00007fffece049e8 EFLAGS: 00000206 ORIG_RAX: 0000000000000000 +RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0f74170fc9 +RDX: 0000000000001000 RSI: 00007fffece049f0 RDI: 0000000000000004 +RBP: 00007fffece05ad0 R08: 0000000000000000 R09: 00007fffece04d90 +R10: 0000000000000000 R11: 0000000000000206 R12: 00005651720a1100 +R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 + + +Allocated by task 298: + kasan_save_stack+0x33/0x60 + kasan_save_track+0x14/0x30 + __kasan_slab_alloc+0x6e/0x70 + kmem_cache_alloc_node_noprof+0xe8/0x330 + copy_process+0x376/0x5e00 + create_io_thread+0xab/0xf0 + io_sq_offload_create+0x9ed/0xf20 + io_uring_setup+0x12b0/0x1cc0 + do_syscall_64+0xa4/0x260 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +Freed by task 22: + kasan_save_stack+0x33/0x60 + kasan_save_track+0x14/0x30 + kasan_save_free_info+0x3b/0x60 + __kasan_slab_free+0x37/0x50 + kmem_cache_free+0xc4/0x360 + rcu_core+0x5ff/0x19f0 + handle_softirqs+0x18c/0x530 + run_ksoftirqd+0x20/0x30 + smpboot_thread_fn+0x287/0x6c0 + kthread+0x30d/0x630 + ret_from_fork+0xef/0x1a0 + ret_from_fork_asm+0x1a/0x30 + +Last potentially related work creation: + kasan_save_stack+0x33/0x60 + kasan_record_aux_stack+0x8c/0xa0 + __call_rcu_common.constprop.0+0x68/0x940 + __schedule+0xff2/0x2930 + __cond_resched+0x4c/0x80 + mutex_lock+0x5c/0xe0 + io_uring_del_tctx_node+0xe1/0x2b0 + io_uring_clean_tctx+0xb7/0x160 + io_uring_cancel_generic+0x34e/0x760 + do_exit+0x240/0x2350 + do_group_exit+0xab/0x220 + __x64_sys_exit_group+0x39/0x40 + x64_sys_call+0x1243/0x1840 + do_syscall_64+0xa4/0x260 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +The buggy address belongs to the object at ffff88810de2cb00 + which belongs to the cache task_struct of size 3712 +The buggy address is located 1992 bytes inside of + freed 3712-byte region [ffff88810de2cb00, ffff88810de2d980) + +which is caused by the task_struct pointed to by sq->thread being +released while it is being used in the function +__io_uring_show_fdinfo(). Holding ctx->uring_lock does not prevent ehre +relase or exit of sq->thread. + +Fix this by assigning and looking up ->thread under RCU, and grabbing a +reference to the task_struct. This ensures that it cannot get released +while fdinfo is using it. + +Reported-by: syzbot+531502bbbe51d2f769f4@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/all/682b06a5.a70a0220.3849cf.00b3.GAE@google.com +Fixes: 3fcb9d17206e ("io_uring/sqpoll: statistics of the true utilization of sq threads") +Signed-off-by: Penglei Jiang +Link: https://lore.kernel.org/r/20250610171801.70960-1-superman.xpt@gmail.com +[axboe: massage commit message] +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + io_uring/fdinfo.c | 12 ++++++++++-- + io_uring/sqpoll.c | 9 ++++----- + 2 files changed, 14 insertions(+), 7 deletions(-) + +diff --git a/io_uring/fdinfo.c b/io_uring/fdinfo.c +index ecdbe473a49f7..c6c624eb9866d 100644 +--- a/io_uring/fdinfo.c ++++ b/io_uring/fdinfo.c +@@ -146,18 +146,26 @@ __cold void io_uring_show_fdinfo(struct seq_file *m, struct file *file) + + if (has_lock && (ctx->flags & IORING_SETUP_SQPOLL)) { + struct io_sq_data *sq = ctx->sq_data; ++ struct task_struct *tsk; + ++ rcu_read_lock(); ++ tsk = rcu_dereference(sq->thread); + /* + * sq->thread might be NULL if we raced with the sqpoll + * thread termination. + */ +- if (sq->thread) { ++ if (tsk) { ++ get_task_struct(tsk); ++ rcu_read_unlock(); ++ getrusage(tsk, RUSAGE_SELF, &sq_usage); ++ put_task_struct(tsk); + sq_pid = sq->task_pid; + sq_cpu = sq->sq_cpu; +- getrusage(sq->thread, RUSAGE_SELF, &sq_usage); + sq_total_time = (sq_usage.ru_stime.tv_sec * 1000000 + + sq_usage.ru_stime.tv_usec); + sq_work_time = sq->work_time; ++ } else { ++ rcu_read_unlock(); + } + } + +diff --git a/io_uring/sqpoll.c b/io_uring/sqpoll.c +index 430922c541681..b0f17a1220ecd 100644 +--- a/io_uring/sqpoll.c ++++ b/io_uring/sqpoll.c +@@ -277,7 +277,8 @@ static int io_sq_thread(void *data) + /* offload context creation failed, just exit */ + if (!current->io_uring) { + mutex_lock(&sqd->lock); +- sqd->thread = NULL; ++ rcu_assign_pointer(sqd->thread, NULL); ++ put_task_struct(current); + mutex_unlock(&sqd->lock); + goto err_out; + } +@@ -386,7 +387,8 @@ static int io_sq_thread(void *data) + io_sq_tw(&retry_list, UINT_MAX); + + io_uring_cancel_generic(true, sqd); +- sqd->thread = NULL; ++ rcu_assign_pointer(sqd->thread, NULL); ++ put_task_struct(current); + list_for_each_entry(ctx, &sqd->ctx_list, sqd_list) + atomic_or(IORING_SQ_NEED_WAKEUP, &ctx->rings->sq_flags); + io_run_task_work(); +@@ -507,9 +509,6 @@ __cold int io_sq_offload_create(struct io_ring_ctx *ctx, + ret = -EINVAL; + goto err; + } +- +- if (task_to_put) +- put_task_struct(task_to_put); + return 0; + err_sqpoll: + complete(&ctx->sq_data->exited); +-- +2.39.5 + diff --git a/queue-6.12/nvmet-fcloop-access-fcpreq-only-when-holding-reqlock.patch b/queue-6.12/nvmet-fcloop-access-fcpreq-only-when-holding-reqlock.patch new file mode 100644 index 0000000000..0217098d01 --- /dev/null +++ b/queue-6.12/nvmet-fcloop-access-fcpreq-only-when-holding-reqlock.patch @@ -0,0 +1,95 @@ +From 3dcd187eeb3cae78ec64ebc49da1b734a5af48e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 May 2025 14:23:03 +0200 +Subject: nvmet-fcloop: access fcpreq only when holding reqlock + +From: Daniel Wagner + +[ Upstream commit 47a827cd7929d0550c3496d70b417fcb5649b27b ] + +The abort handling logic expects that the state and the fcpreq are only +accessed when holding the reqlock lock. + +While at it, only handle the aborts in the abort handler. + +Signed-off-by: Daniel Wagner +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/fcloop.c | 31 ++++++++++++++++--------------- + 1 file changed, 16 insertions(+), 15 deletions(-) + +diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c +index da195d61a9664..f1b5ffc00ce88 100644 +--- a/drivers/nvme/target/fcloop.c ++++ b/drivers/nvme/target/fcloop.c +@@ -623,12 +623,13 @@ fcloop_fcp_recv_work(struct work_struct *work) + { + struct fcloop_fcpreq *tfcp_req = + container_of(work, struct fcloop_fcpreq, fcp_rcv_work); +- struct nvmefc_fcp_req *fcpreq = tfcp_req->fcpreq; ++ struct nvmefc_fcp_req *fcpreq; + unsigned long flags; + int ret = 0; + bool aborted = false; + + spin_lock_irqsave(&tfcp_req->reqlock, flags); ++ fcpreq = tfcp_req->fcpreq; + switch (tfcp_req->inistate) { + case INI_IO_START: + tfcp_req->inistate = INI_IO_ACTIVE; +@@ -643,16 +644,19 @@ fcloop_fcp_recv_work(struct work_struct *work) + } + spin_unlock_irqrestore(&tfcp_req->reqlock, flags); + +- if (unlikely(aborted)) +- ret = -ECANCELED; +- else { +- if (likely(!check_for_drop(tfcp_req))) +- ret = nvmet_fc_rcv_fcp_req(tfcp_req->tport->targetport, +- &tfcp_req->tgt_fcp_req, +- fcpreq->cmdaddr, fcpreq->cmdlen); +- else +- pr_info("%s: dropped command ********\n", __func__); ++ if (unlikely(aborted)) { ++ /* the abort handler will call fcloop_call_host_done */ ++ return; ++ } ++ ++ if (unlikely(check_for_drop(tfcp_req))) { ++ pr_info("%s: dropped command ********\n", __func__); ++ return; + } ++ ++ ret = nvmet_fc_rcv_fcp_req(tfcp_req->tport->targetport, ++ &tfcp_req->tgt_fcp_req, ++ fcpreq->cmdaddr, fcpreq->cmdlen); + if (ret) + fcloop_call_host_done(fcpreq, tfcp_req, ret); + } +@@ -667,9 +671,10 @@ fcloop_fcp_abort_recv_work(struct work_struct *work) + unsigned long flags; + + spin_lock_irqsave(&tfcp_req->reqlock, flags); +- fcpreq = tfcp_req->fcpreq; + switch (tfcp_req->inistate) { + case INI_IO_ABORTED: ++ fcpreq = tfcp_req->fcpreq; ++ tfcp_req->fcpreq = NULL; + break; + case INI_IO_COMPLETED: + completed = true; +@@ -691,10 +696,6 @@ fcloop_fcp_abort_recv_work(struct work_struct *work) + nvmet_fc_rcv_fcp_abort(tfcp_req->tport->targetport, + &tfcp_req->tgt_fcp_req); + +- spin_lock_irqsave(&tfcp_req->reqlock, flags); +- tfcp_req->fcpreq = NULL; +- spin_unlock_irqrestore(&tfcp_req->reqlock, flags); +- + fcloop_call_host_done(fcpreq, tfcp_req, -ECANCELED); + /* call_host_done releases reference for abort downcall */ + } +-- +2.39.5 + diff --git a/queue-6.12/perf-ensure-bpf_perf_link-path-is-properly-serialize.patch b/queue-6.12/perf-ensure-bpf_perf_link-path-is-properly-serialize.patch new file mode 100644 index 0000000000..b69df93a57 --- /dev/null +++ b/queue-6.12/perf-ensure-bpf_perf_link-path-is-properly-serialize.patch @@ -0,0 +1,98 @@ +From 58c82e6601080554d8d7f0f431a8fc9ca48dffc9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Jan 2025 10:54:50 +0100 +Subject: perf: Ensure bpf_perf_link path is properly serialized + +From: Peter Zijlstra + +[ Upstream commit 7ed9138a72829d2035ecbd8dbd35b1bc3c137c40 ] + +Ravi reported that the bpf_perf_link_attach() usage of +perf_event_set_bpf_prog() is not serialized by ctx->mutex, unlike the +PERF_EVENT_IOC_SET_BPF case. + +Reported-by: Ravi Bangoria +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Ravi Bangoria +Link: https://lkml.kernel.org/r/20250307193305.486326750@infradead.org +Signed-off-by: Sasha Levin +--- + kernel/events/core.c | 34 ++++++++++++++++++++++++++++++---- + 1 file changed, 30 insertions(+), 4 deletions(-) + +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 8352376d82154..9ce82904f761d 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -6031,6 +6031,9 @@ static int perf_event_set_output(struct perf_event *event, + static int perf_event_set_filter(struct perf_event *event, void __user *arg); + static int perf_copy_attr(struct perf_event_attr __user *uattr, + struct perf_event_attr *attr); ++static int __perf_event_set_bpf_prog(struct perf_event *event, ++ struct bpf_prog *prog, ++ u64 bpf_cookie); + + static long _perf_ioctl(struct perf_event *event, unsigned int cmd, unsigned long arg) + { +@@ -6099,7 +6102,7 @@ static long _perf_ioctl(struct perf_event *event, unsigned int cmd, unsigned lon + if (IS_ERR(prog)) + return PTR_ERR(prog); + +- err = perf_event_set_bpf_prog(event, prog, 0); ++ err = __perf_event_set_bpf_prog(event, prog, 0); + if (err) { + bpf_prog_put(prog); + return err; +@@ -10756,8 +10759,9 @@ static inline bool perf_event_is_tracing(struct perf_event *event) + return false; + } + +-int perf_event_set_bpf_prog(struct perf_event *event, struct bpf_prog *prog, +- u64 bpf_cookie) ++static int __perf_event_set_bpf_prog(struct perf_event *event, ++ struct bpf_prog *prog, ++ u64 bpf_cookie) + { + bool is_kprobe, is_uprobe, is_tracepoint, is_syscall_tp; + +@@ -10795,6 +10799,20 @@ int perf_event_set_bpf_prog(struct perf_event *event, struct bpf_prog *prog, + return perf_event_attach_bpf_prog(event, prog, bpf_cookie); + } + ++int perf_event_set_bpf_prog(struct perf_event *event, ++ struct bpf_prog *prog, ++ u64 bpf_cookie) ++{ ++ struct perf_event_context *ctx; ++ int ret; ++ ++ ctx = perf_event_ctx_lock(event); ++ ret = __perf_event_set_bpf_prog(event, prog, bpf_cookie); ++ perf_event_ctx_unlock(event, ctx); ++ ++ return ret; ++} ++ + void perf_event_free_bpf_prog(struct perf_event *event) + { + if (!perf_event_is_tracing(event)) { +@@ -10814,7 +10832,15 @@ static void perf_event_free_filter(struct perf_event *event) + { + } + +-int perf_event_set_bpf_prog(struct perf_event *event, struct bpf_prog *prog, ++static int __perf_event_set_bpf_prog(struct perf_event *event, ++ struct bpf_prog *prog, ++ u64 bpf_cookie) ++{ ++ return -ENOENT; ++} ++ ++int perf_event_set_bpf_prog(struct perf_event *event, ++ struct bpf_prog *prog, + u64 bpf_cookie) + { + return -ENOENT; +-- +2.39.5 + diff --git a/queue-6.12/series b/queue-6.12/series index 0e07e466d7..71e7a4d478 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -472,3 +472,15 @@ net_sched-red-fix-a-race-in-__red_change.patch net_sched-tbf-fix-a-race-in-tbf_change.patch net_sched-ets-fix-a-race-in-ets_qdisc_change.patch net-drv-netdevsim-don-t-napi_complete-from-netpoll.patch +btrfs-exit-after-state-insertion-failure-at-btrfs_co.patch +fs-filesystems-fix-potential-unsigned-integer-underf.patch +gfs2-pass-through-holder-from-the-vfs-for-freeze-tha.patch +btrfs-exit-after-state-split-error-at-set_extent_bit.patch +nvmet-fcloop-access-fcpreq-only-when-holding-reqlock.patch +perf-ensure-bpf_perf_link-path-is-properly-serialize.patch +block-use-q-elevator-with-elevator_lock-held-in-elv_.patch +io_uring-fix-use-after-free-of-sq-thread-in-__io_uri.patch +block-don-t-use-submit_bio_noacct_nocheck-in-blk_zon.patch +io_uring-consistently-use-rcu-semantics-with-sqpoll-.patch +bio-fix-bio_first_folio-for-sparsemem-without-vmemma.patch +block-fix-bvec_set_folio-for-very-large-folios.patch