From: Greg Kroah-Hartman Date: Wed, 19 Mar 2025 14:20:31 +0000 (-0700) Subject: 6.12-stable patches X-Git-Tag: v6.6.84~4 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=97155778171b998771d2e33d81f2bd14639468cc;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: fs-netfs-read_collect-add-to-next-prev_donated.patch --- diff --git a/queue-6.12/fs-netfs-read_collect-add-to-next-prev_donated.patch b/queue-6.12/fs-netfs-read_collect-add-to-next-prev_donated.patch new file mode 100644 index 0000000000..4b57bbc7b0 --- /dev/null +++ b/queue-6.12/fs-netfs-read_collect-add-to-next-prev_donated.patch @@ -0,0 +1,41 @@ +From stable+bounces-118455-greg=kroah.com@vger.kernel.org Thu Feb 20 07:27:34 2025 +From: Max Kellermann +Date: Thu, 20 Feb 2025 16:24:50 +0100 +Subject: fs/netfs/read_collect: add to next->prev_donated +To: dhowells@redhat.com, netfs@lists.linux.dev, linux-kernel@vger.kernel.org +Cc: Max Kellermann , stable@vger.kernel.org +Message-ID: <20250220152450.1075727-1-max.kellermann@ionos.com> + +From: Max Kellermann + +If multiple subrequests donate data to the same "next" request +(depending on the subrequest completion order), each of them would +overwrite the `prev_donated` field, causing data corruption and a +BUG() crash ("Can't donate prior to front"). + +Fixes: ee4cdf7ba857 ("netfs: Speed up buffered reading") +Closes: https://lore.kernel.org/netfs/CAKPOu+_4mUwYgQtRTbXCmi+-k3PGvLysnPadkmHOyB7Gz0iSMA@mail.gmail.com/ +Cc: stable@vger.kernel.org +Signed-off-by: Max Kellermann +Signed-off-by: David Howells +Signed-off-by: Greg Kroah-Hartman +--- + fs/netfs/read_collect.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/netfs/read_collect.c b/fs/netfs/read_collect.c +index 8878b46589ff..cafadfe8e858 100644 +--- a/fs/netfs/read_collect.c ++++ b/fs/netfs/read_collect.c +@@ -284,7 +284,7 @@ static bool netfs_consume_read_data(struct netfs_io_subrequest *subreq, bool was + netfs_trace_donate_to_deferred_next); + } else { + next = list_next_entry(subreq, rreq_link); +- WRITE_ONCE(next->prev_donated, excess); ++ WRITE_ONCE(next->prev_donated, next->prev_donated + excess); + trace_netfs_donate(rreq, subreq, next, excess, + netfs_trace_donate_to_next); + } +-- +2.47.2 + diff --git a/queue-6.12/series b/queue-6.12/series index 56cbc42933..fcecd0950c 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -228,3 +228,4 @@ tools-sched_ext-add-helper-to-check-task-migration-state.patch bluetooth-l2cap-fix-corrupted-list-in-hci_chan_del.patch nvme-fc-rely-on-state-transitions-to-handle-connectivity-loss.patch hid-apple-disable-fn-key-handling-on-the-omoton-kb066.patch +fs-netfs-read_collect-add-to-next-prev_donated.patch