From 69c7982be3844ecf5bb317c89825125e0e50f73d Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 4 Mar 2024 21:06:47 +0000 Subject: [PATCH] drop fs-aio-make-io_cancel-generate-completions-again.patch from everywhere --- ...io_cancel-generate-completions-again.patch | 85 ------------------- queue-4.19/series | 1 - ...io_cancel-generate-completions-again.patch | 85 ------------------- queue-5.10/series | 1 - ...io_cancel-generate-completions-again.patch | 85 ------------------- queue-5.15/series | 1 - ...io_cancel-generate-completions-again.patch | 85 ------------------- queue-5.4/series | 1 - ...io_cancel-generate-completions-again.patch | 85 ------------------- queue-6.1/series | 1 - ...io_cancel-generate-completions-again.patch | 85 ------------------- queue-6.6/series | 1 - ...io_cancel-generate-completions-again.patch | 85 ------------------- queue-6.7/series | 1 - 14 files changed, 602 deletions(-) delete mode 100644 queue-4.19/fs-aio-make-io_cancel-generate-completions-again.patch delete mode 100644 queue-5.10/fs-aio-make-io_cancel-generate-completions-again.patch delete mode 100644 queue-5.15/fs-aio-make-io_cancel-generate-completions-again.patch delete mode 100644 queue-5.4/fs-aio-make-io_cancel-generate-completions-again.patch delete mode 100644 queue-6.1/fs-aio-make-io_cancel-generate-completions-again.patch delete mode 100644 queue-6.6/fs-aio-make-io_cancel-generate-completions-again.patch delete mode 100644 queue-6.7/fs-aio-make-io_cancel-generate-completions-again.patch diff --git a/queue-4.19/fs-aio-make-io_cancel-generate-completions-again.patch b/queue-4.19/fs-aio-make-io_cancel-generate-completions-again.patch deleted file mode 100644 index 4841c176e4d..00000000000 --- a/queue-4.19/fs-aio-make-io_cancel-generate-completions-again.patch +++ /dev/null @@ -1,85 +0,0 @@ -From 54cbc058d86beca3515c994039b5c0f0a34f53dd Mon Sep 17 00:00:00 2001 -From: Bart Van Assche -Date: Thu, 15 Feb 2024 12:47:39 -0800 -Subject: fs/aio: Make io_cancel() generate completions again - -From: Bart Van Assche - -commit 54cbc058d86beca3515c994039b5c0f0a34f53dd upstream. - -The following patch accidentally removed the code for delivering -completions for cancelled reads and writes to user space: "[PATCH 04/33] -aio: remove retry-based AIO" -(https://lore.kernel.org/all/1363883754-27966-5-git-send-email-koverstreet@google.com/) ->From that patch: - -- if (kiocbIsCancelled(iocb)) { -- ret = -EINTR; -- aio_complete(iocb, ret, 0); -- /* must not access the iocb after this */ -- goto out; -- } - -This leads to a leak in user space of a struct iocb. Hence this patch -that restores the code that reports to user space that a read or write -has been cancelled successfully. - -Fixes: 41003a7bcfed ("aio: remove retry-based AIO") -Cc: Christoph Hellwig -Cc: Avi Kivity -Cc: Sandeep Dhavale -Cc: Jens Axboe -Cc: Greg Kroah-Hartman -Cc: Kent Overstreet -Cc: stable@vger.kernel.org -Signed-off-by: Bart Van Assche -Link: https://lore.kernel.org/r/20240215204739.2677806-3-bvanassche@acm.org -Signed-off-by: Christian Brauner -Signed-off-by: Greg Kroah-Hartman ---- - fs/aio.c | 27 +++++++++++---------------- - 1 file changed, 11 insertions(+), 16 deletions(-) - ---- a/fs/aio.c -+++ b/fs/aio.c -@@ -2131,14 +2131,11 @@ COMPAT_SYSCALL_DEFINE3(io_submit, compat - #endif - - /* sys_io_cancel: -- * Attempts to cancel an iocb previously passed to io_submit. If -- * the operation is successfully cancelled, the resulting event is -- * copied into the memory pointed to by result without being placed -- * into the completion queue and 0 is returned. May fail with -- * -EFAULT if any of the data structures pointed to are invalid. -- * May fail with -EINVAL if aio_context specified by ctx_id is -- * invalid. May fail with -EAGAIN if the iocb specified was not -- * cancelled. Will fail with -ENOSYS if not implemented. -+ * Attempts to cancel an iocb previously passed to io_submit(). If the -+ * operation is successfully cancelled 0 is returned. May fail with -+ * -EFAULT if any of the data structures pointed to are invalid. May -+ * fail with -EINVAL if aio_context specified by ctx_id is invalid. Will -+ * fail with -ENOSYS if not implemented. - */ - SYSCALL_DEFINE3(io_cancel, aio_context_t, ctx_id, struct iocb __user *, iocb, - struct io_event __user *, result) -@@ -2169,14 +2166,12 @@ SYSCALL_DEFINE3(io_cancel, aio_context_t - } - spin_unlock_irq(&ctx->ctx_lock); - -- if (!ret) { -- /* -- * The result argument is no longer used - the io_event is -- * always delivered via the ring buffer. -EINPROGRESS indicates -- * cancellation is progress: -- */ -- ret = -EINPROGRESS; -- } -+ /* -+ * The result argument is no longer used - the io_event is always -+ * delivered via the ring buffer. -+ */ -+ if (ret == 0 && kiocb->rw.ki_flags & IOCB_AIO_RW) -+ aio_complete_rw(&kiocb->rw, -EINTR, 0); - - percpu_ref_put(&ctx->users); - diff --git a/queue-4.19/series b/queue-4.19/series index 0796eaa8294..13484f3a894 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -12,6 +12,5 @@ gtp-fix-use-after-free-and-null-ptr-deref-in-gtp_newlink.patch wifi-nl80211-reject-iftype-change-with-mesh-id-change.patch btrfs-dev-replace-properly-validate-device-names.patch mmc-core-fix-emmc-initialization-with-1-bit-bus-connection.patch -fs-aio-make-io_cancel-generate-completions-again.patch cachefiles-fix-memory-leak-in-cachefiles_add_cache.patch gpio-74x164-enable-output-pins-after-registers-are-r.patch diff --git a/queue-5.10/fs-aio-make-io_cancel-generate-completions-again.patch b/queue-5.10/fs-aio-make-io_cancel-generate-completions-again.patch deleted file mode 100644 index 10f73245faf..00000000000 --- a/queue-5.10/fs-aio-make-io_cancel-generate-completions-again.patch +++ /dev/null @@ -1,85 +0,0 @@ -From 54cbc058d86beca3515c994039b5c0f0a34f53dd Mon Sep 17 00:00:00 2001 -From: Bart Van Assche -Date: Thu, 15 Feb 2024 12:47:39 -0800 -Subject: fs/aio: Make io_cancel() generate completions again - -From: Bart Van Assche - -commit 54cbc058d86beca3515c994039b5c0f0a34f53dd upstream. - -The following patch accidentally removed the code for delivering -completions for cancelled reads and writes to user space: "[PATCH 04/33] -aio: remove retry-based AIO" -(https://lore.kernel.org/all/1363883754-27966-5-git-send-email-koverstreet@google.com/) ->From that patch: - -- if (kiocbIsCancelled(iocb)) { -- ret = -EINTR; -- aio_complete(iocb, ret, 0); -- /* must not access the iocb after this */ -- goto out; -- } - -This leads to a leak in user space of a struct iocb. Hence this patch -that restores the code that reports to user space that a read or write -has been cancelled successfully. - -Fixes: 41003a7bcfed ("aio: remove retry-based AIO") -Cc: Christoph Hellwig -Cc: Avi Kivity -Cc: Sandeep Dhavale -Cc: Jens Axboe -Cc: Greg Kroah-Hartman -Cc: Kent Overstreet -Cc: stable@vger.kernel.org -Signed-off-by: Bart Van Assche -Link: https://lore.kernel.org/r/20240215204739.2677806-3-bvanassche@acm.org -Signed-off-by: Christian Brauner -Signed-off-by: Greg Kroah-Hartman ---- - fs/aio.c | 27 +++++++++++---------------- - 1 file changed, 11 insertions(+), 16 deletions(-) - ---- a/fs/aio.c -+++ b/fs/aio.c -@@ -2121,14 +2121,11 @@ COMPAT_SYSCALL_DEFINE3(io_submit, compat - #endif - - /* sys_io_cancel: -- * Attempts to cancel an iocb previously passed to io_submit. If -- * the operation is successfully cancelled, the resulting event is -- * copied into the memory pointed to by result without being placed -- * into the completion queue and 0 is returned. May fail with -- * -EFAULT if any of the data structures pointed to are invalid. -- * May fail with -EINVAL if aio_context specified by ctx_id is -- * invalid. May fail with -EAGAIN if the iocb specified was not -- * cancelled. Will fail with -ENOSYS if not implemented. -+ * Attempts to cancel an iocb previously passed to io_submit(). If the -+ * operation is successfully cancelled 0 is returned. May fail with -+ * -EFAULT if any of the data structures pointed to are invalid. May -+ * fail with -EINVAL if aio_context specified by ctx_id is invalid. Will -+ * fail with -ENOSYS if not implemented. - */ - SYSCALL_DEFINE3(io_cancel, aio_context_t, ctx_id, struct iocb __user *, iocb, - struct io_event __user *, result) -@@ -2159,14 +2156,12 @@ SYSCALL_DEFINE3(io_cancel, aio_context_t - } - spin_unlock_irq(&ctx->ctx_lock); - -- if (!ret) { -- /* -- * The result argument is no longer used - the io_event is -- * always delivered via the ring buffer. -EINPROGRESS indicates -- * cancellation is progress: -- */ -- ret = -EINPROGRESS; -- } -+ /* -+ * The result argument is no longer used - the io_event is always -+ * delivered via the ring buffer. -+ */ -+ if (ret == 0 && kiocb->rw.ki_flags & IOCB_AIO_RW) -+ aio_complete_rw(&kiocb->rw, -EINTR, 0); - - percpu_ref_put(&ctx->users); - diff --git a/queue-5.10/series b/queue-5.10/series index 12ad6436978..bd261a5fc8b 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -30,7 +30,6 @@ mmc-sdhci-xenon-add-timeout-for-phy-init-complete.patch mmc-sdhci-xenon-fix-phy-init-clock-stability.patch riscv-add-caller_addrx-support.patch pmdomain-qcom-rpmhpd-fix-enabled_corner-aggregation.patch -fs-aio-make-io_cancel-generate-completions-again.patch x86-cpu-intel-detect-tme-keyid-bits-before-setting-mtrr-mask-registers.patch mptcp-fix-possible-deadlock-in-subflow-diag.patch ext4-avoid-bb_free-and-bb_fragments-inconsistency-in-mb_free_blocks.patch diff --git a/queue-5.15/fs-aio-make-io_cancel-generate-completions-again.patch b/queue-5.15/fs-aio-make-io_cancel-generate-completions-again.patch deleted file mode 100644 index c42b389a9f2..00000000000 --- a/queue-5.15/fs-aio-make-io_cancel-generate-completions-again.patch +++ /dev/null @@ -1,85 +0,0 @@ -From 54cbc058d86beca3515c994039b5c0f0a34f53dd Mon Sep 17 00:00:00 2001 -From: Bart Van Assche -Date: Thu, 15 Feb 2024 12:47:39 -0800 -Subject: fs/aio: Make io_cancel() generate completions again - -From: Bart Van Assche - -commit 54cbc058d86beca3515c994039b5c0f0a34f53dd upstream. - -The following patch accidentally removed the code for delivering -completions for cancelled reads and writes to user space: "[PATCH 04/33] -aio: remove retry-based AIO" -(https://lore.kernel.org/all/1363883754-27966-5-git-send-email-koverstreet@google.com/) ->From that patch: - -- if (kiocbIsCancelled(iocb)) { -- ret = -EINTR; -- aio_complete(iocb, ret, 0); -- /* must not access the iocb after this */ -- goto out; -- } - -This leads to a leak in user space of a struct iocb. Hence this patch -that restores the code that reports to user space that a read or write -has been cancelled successfully. - -Fixes: 41003a7bcfed ("aio: remove retry-based AIO") -Cc: Christoph Hellwig -Cc: Avi Kivity -Cc: Sandeep Dhavale -Cc: Jens Axboe -Cc: Greg Kroah-Hartman -Cc: Kent Overstreet -Cc: stable@vger.kernel.org -Signed-off-by: Bart Van Assche -Link: https://lore.kernel.org/r/20240215204739.2677806-3-bvanassche@acm.org -Signed-off-by: Christian Brauner -Signed-off-by: Greg Kroah-Hartman ---- - fs/aio.c | 27 +++++++++++---------------- - 1 file changed, 11 insertions(+), 16 deletions(-) - ---- a/fs/aio.c -+++ b/fs/aio.c -@@ -2120,14 +2120,11 @@ COMPAT_SYSCALL_DEFINE3(io_submit, compat - #endif - - /* sys_io_cancel: -- * Attempts to cancel an iocb previously passed to io_submit. If -- * the operation is successfully cancelled, the resulting event is -- * copied into the memory pointed to by result without being placed -- * into the completion queue and 0 is returned. May fail with -- * -EFAULT if any of the data structures pointed to are invalid. -- * May fail with -EINVAL if aio_context specified by ctx_id is -- * invalid. May fail with -EAGAIN if the iocb specified was not -- * cancelled. Will fail with -ENOSYS if not implemented. -+ * Attempts to cancel an iocb previously passed to io_submit(). If the -+ * operation is successfully cancelled 0 is returned. May fail with -+ * -EFAULT if any of the data structures pointed to are invalid. May -+ * fail with -EINVAL if aio_context specified by ctx_id is invalid. Will -+ * fail with -ENOSYS if not implemented. - */ - SYSCALL_DEFINE3(io_cancel, aio_context_t, ctx_id, struct iocb __user *, iocb, - struct io_event __user *, result) -@@ -2158,14 +2155,12 @@ SYSCALL_DEFINE3(io_cancel, aio_context_t - } - spin_unlock_irq(&ctx->ctx_lock); - -- if (!ret) { -- /* -- * The result argument is no longer used - the io_event is -- * always delivered via the ring buffer. -EINPROGRESS indicates -- * cancellation is progress: -- */ -- ret = -EINPROGRESS; -- } -+ /* -+ * The result argument is no longer used - the io_event is always -+ * delivered via the ring buffer. -+ */ -+ if (ret == 0 && kiocb->rw.ki_flags & IOCB_AIO_RW) -+ aio_complete_rw(&kiocb->rw, -EINTR, 0); - - percpu_ref_put(&ctx->users); - diff --git a/queue-5.15/series b/queue-5.15/series index a69bf905da9..7a50e463290 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -57,7 +57,6 @@ mmc-sdhci-xenon-add-timeout-for-phy-init-complete.patch mmc-sdhci-xenon-fix-phy-init-clock-stability.patch riscv-add-caller_addrx-support.patch pmdomain-qcom-rpmhpd-fix-enabled_corner-aggregation.patch -fs-aio-make-io_cancel-generate-completions-again.patch x86-cpu-intel-detect-tme-keyid-bits-before-setting-mtrr-mask-registers.patch mptcp-move-__mptcp_error_report-in-protocol.c.patch mptcp-process-pending-subflow-error-on-close.patch diff --git a/queue-5.4/fs-aio-make-io_cancel-generate-completions-again.patch b/queue-5.4/fs-aio-make-io_cancel-generate-completions-again.patch deleted file mode 100644 index f6ac934fcec..00000000000 --- a/queue-5.4/fs-aio-make-io_cancel-generate-completions-again.patch +++ /dev/null @@ -1,85 +0,0 @@ -From 54cbc058d86beca3515c994039b5c0f0a34f53dd Mon Sep 17 00:00:00 2001 -From: Bart Van Assche -Date: Thu, 15 Feb 2024 12:47:39 -0800 -Subject: fs/aio: Make io_cancel() generate completions again - -From: Bart Van Assche - -commit 54cbc058d86beca3515c994039b5c0f0a34f53dd upstream. - -The following patch accidentally removed the code for delivering -completions for cancelled reads and writes to user space: "[PATCH 04/33] -aio: remove retry-based AIO" -(https://lore.kernel.org/all/1363883754-27966-5-git-send-email-koverstreet@google.com/) ->From that patch: - -- if (kiocbIsCancelled(iocb)) { -- ret = -EINTR; -- aio_complete(iocb, ret, 0); -- /* must not access the iocb after this */ -- goto out; -- } - -This leads to a leak in user space of a struct iocb. Hence this patch -that restores the code that reports to user space that a read or write -has been cancelled successfully. - -Fixes: 41003a7bcfed ("aio: remove retry-based AIO") -Cc: Christoph Hellwig -Cc: Avi Kivity -Cc: Sandeep Dhavale -Cc: Jens Axboe -Cc: Greg Kroah-Hartman -Cc: Kent Overstreet -Cc: stable@vger.kernel.org -Signed-off-by: Bart Van Assche -Link: https://lore.kernel.org/r/20240215204739.2677806-3-bvanassche@acm.org -Signed-off-by: Christian Brauner -Signed-off-by: Greg Kroah-Hartman ---- - fs/aio.c | 27 +++++++++++---------------- - 1 file changed, 11 insertions(+), 16 deletions(-) - ---- a/fs/aio.c -+++ b/fs/aio.c -@@ -2126,14 +2126,11 @@ COMPAT_SYSCALL_DEFINE3(io_submit, compat - #endif - - /* sys_io_cancel: -- * Attempts to cancel an iocb previously passed to io_submit. If -- * the operation is successfully cancelled, the resulting event is -- * copied into the memory pointed to by result without being placed -- * into the completion queue and 0 is returned. May fail with -- * -EFAULT if any of the data structures pointed to are invalid. -- * May fail with -EINVAL if aio_context specified by ctx_id is -- * invalid. May fail with -EAGAIN if the iocb specified was not -- * cancelled. Will fail with -ENOSYS if not implemented. -+ * Attempts to cancel an iocb previously passed to io_submit(). If the -+ * operation is successfully cancelled 0 is returned. May fail with -+ * -EFAULT if any of the data structures pointed to are invalid. May -+ * fail with -EINVAL if aio_context specified by ctx_id is invalid. Will -+ * fail with -ENOSYS if not implemented. - */ - SYSCALL_DEFINE3(io_cancel, aio_context_t, ctx_id, struct iocb __user *, iocb, - struct io_event __user *, result) -@@ -2164,14 +2161,12 @@ SYSCALL_DEFINE3(io_cancel, aio_context_t - } - spin_unlock_irq(&ctx->ctx_lock); - -- if (!ret) { -- /* -- * The result argument is no longer used - the io_event is -- * always delivered via the ring buffer. -EINPROGRESS indicates -- * cancellation is progress: -- */ -- ret = -EINPROGRESS; -- } -+ /* -+ * The result argument is no longer used - the io_event is always -+ * delivered via the ring buffer. -+ */ -+ if (ret == 0 && kiocb->rw.ki_flags & IOCB_AIO_RW) -+ aio_complete_rw(&kiocb->rw, -EINTR, 0); - - percpu_ref_put(&ctx->users); - diff --git a/queue-5.4/series b/queue-5.4/series index eef1e58edcd..f9bef2290e9 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -19,7 +19,6 @@ btrfs-dev-replace-properly-validate-device-names.patch dmaengine-fsl-qdma-fix-soc-may-hang-on-16-byte-unaligned-read.patch dmaengine-fsl-qdma-init-irq-after-reg-initialization.patch mmc-core-fix-emmc-initialization-with-1-bit-bus-connection.patch -fs-aio-make-io_cancel-generate-completions-again.patch x86-cpu-intel-detect-tme-keyid-bits-before-setting-mtrr-mask-registers.patch cachefiles-fix-memory-leak-in-cachefiles_add_cache.patch fs-hugetlb-fix-null-pointer-dereference-in-hugetlbs_fill_super.patch diff --git a/queue-6.1/fs-aio-make-io_cancel-generate-completions-again.patch b/queue-6.1/fs-aio-make-io_cancel-generate-completions-again.patch deleted file mode 100644 index 18eb2585cca..00000000000 --- a/queue-6.1/fs-aio-make-io_cancel-generate-completions-again.patch +++ /dev/null @@ -1,85 +0,0 @@ -From 54cbc058d86beca3515c994039b5c0f0a34f53dd Mon Sep 17 00:00:00 2001 -From: Bart Van Assche -Date: Thu, 15 Feb 2024 12:47:39 -0800 -Subject: fs/aio: Make io_cancel() generate completions again - -From: Bart Van Assche - -commit 54cbc058d86beca3515c994039b5c0f0a34f53dd upstream. - -The following patch accidentally removed the code for delivering -completions for cancelled reads and writes to user space: "[PATCH 04/33] -aio: remove retry-based AIO" -(https://lore.kernel.org/all/1363883754-27966-5-git-send-email-koverstreet@google.com/) ->From that patch: - -- if (kiocbIsCancelled(iocb)) { -- ret = -EINTR; -- aio_complete(iocb, ret, 0); -- /* must not access the iocb after this */ -- goto out; -- } - -This leads to a leak in user space of a struct iocb. Hence this patch -that restores the code that reports to user space that a read or write -has been cancelled successfully. - -Fixes: 41003a7bcfed ("aio: remove retry-based AIO") -Cc: Christoph Hellwig -Cc: Avi Kivity -Cc: Sandeep Dhavale -Cc: Jens Axboe -Cc: Greg Kroah-Hartman -Cc: Kent Overstreet -Cc: stable@vger.kernel.org -Signed-off-by: Bart Van Assche -Link: https://lore.kernel.org/r/20240215204739.2677806-3-bvanassche@acm.org -Signed-off-by: Christian Brauner -Signed-off-by: Greg Kroah-Hartman ---- - fs/aio.c | 27 +++++++++++---------------- - 1 file changed, 11 insertions(+), 16 deletions(-) - ---- a/fs/aio.c -+++ b/fs/aio.c -@@ -2141,14 +2141,11 @@ COMPAT_SYSCALL_DEFINE3(io_submit, compat - #endif - - /* sys_io_cancel: -- * Attempts to cancel an iocb previously passed to io_submit. If -- * the operation is successfully cancelled, the resulting event is -- * copied into the memory pointed to by result without being placed -- * into the completion queue and 0 is returned. May fail with -- * -EFAULT if any of the data structures pointed to are invalid. -- * May fail with -EINVAL if aio_context specified by ctx_id is -- * invalid. May fail with -EAGAIN if the iocb specified was not -- * cancelled. Will fail with -ENOSYS if not implemented. -+ * Attempts to cancel an iocb previously passed to io_submit(). If the -+ * operation is successfully cancelled 0 is returned. May fail with -+ * -EFAULT if any of the data structures pointed to are invalid. May -+ * fail with -EINVAL if aio_context specified by ctx_id is invalid. Will -+ * fail with -ENOSYS if not implemented. - */ - SYSCALL_DEFINE3(io_cancel, aio_context_t, ctx_id, struct iocb __user *, iocb, - struct io_event __user *, result) -@@ -2179,14 +2176,12 @@ SYSCALL_DEFINE3(io_cancel, aio_context_t - } - spin_unlock_irq(&ctx->ctx_lock); - -- if (!ret) { -- /* -- * The result argument is no longer used - the io_event is -- * always delivered via the ring buffer. -EINPROGRESS indicates -- * cancellation is progress: -- */ -- ret = -EINPROGRESS; -- } -+ /* -+ * The result argument is no longer used - the io_event is always -+ * delivered via the ring buffer. -+ */ -+ if (ret == 0 && kiocb->rw.ki_flags & IOCB_AIO_RW) -+ aio_complete_rw(&kiocb->rw, -EINTR); - - percpu_ref_put(&ctx->users); - diff --git a/queue-6.1/series b/queue-6.1/series index 326e3920264..851191a6ed1 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -92,7 +92,6 @@ mmc-sdhci-xenon-fix-phy-init-clock-stability.patch riscv-add-caller_addrx-support.patch efivarfs-request-at-most-512-bytes-for-variable-names.patch pmdomain-qcom-rpmhpd-fix-enabled_corner-aggregation.patch -fs-aio-make-io_cancel-generate-completions-again.patch x86-e820-don-t-reserve-setup_rng_seed-in-e820.patch x86-cpu-intel-detect-tme-keyid-bits-before-setting-mtrr-mask-registers.patch mptcp-fix-data-races-on-local_id.patch diff --git a/queue-6.6/fs-aio-make-io_cancel-generate-completions-again.patch b/queue-6.6/fs-aio-make-io_cancel-generate-completions-again.patch deleted file mode 100644 index 1969e81c03b..00000000000 --- a/queue-6.6/fs-aio-make-io_cancel-generate-completions-again.patch +++ /dev/null @@ -1,85 +0,0 @@ -From 54cbc058d86beca3515c994039b5c0f0a34f53dd Mon Sep 17 00:00:00 2001 -From: Bart Van Assche -Date: Thu, 15 Feb 2024 12:47:39 -0800 -Subject: fs/aio: Make io_cancel() generate completions again - -From: Bart Van Assche - -commit 54cbc058d86beca3515c994039b5c0f0a34f53dd upstream. - -The following patch accidentally removed the code for delivering -completions for cancelled reads and writes to user space: "[PATCH 04/33] -aio: remove retry-based AIO" -(https://lore.kernel.org/all/1363883754-27966-5-git-send-email-koverstreet@google.com/) ->From that patch: - -- if (kiocbIsCancelled(iocb)) { -- ret = -EINTR; -- aio_complete(iocb, ret, 0); -- /* must not access the iocb after this */ -- goto out; -- } - -This leads to a leak in user space of a struct iocb. Hence this patch -that restores the code that reports to user space that a read or write -has been cancelled successfully. - -Fixes: 41003a7bcfed ("aio: remove retry-based AIO") -Cc: Christoph Hellwig -Cc: Avi Kivity -Cc: Sandeep Dhavale -Cc: Jens Axboe -Cc: Greg Kroah-Hartman -Cc: Kent Overstreet -Cc: stable@vger.kernel.org -Signed-off-by: Bart Van Assche -Link: https://lore.kernel.org/r/20240215204739.2677806-3-bvanassche@acm.org -Signed-off-by: Christian Brauner -Signed-off-by: Greg Kroah-Hartman ---- - fs/aio.c | 27 +++++++++++---------------- - 1 file changed, 11 insertions(+), 16 deletions(-) - ---- a/fs/aio.c -+++ b/fs/aio.c -@@ -2119,14 +2119,11 @@ COMPAT_SYSCALL_DEFINE3(io_submit, compat - #endif - - /* sys_io_cancel: -- * Attempts to cancel an iocb previously passed to io_submit. If -- * the operation is successfully cancelled, the resulting event is -- * copied into the memory pointed to by result without being placed -- * into the completion queue and 0 is returned. May fail with -- * -EFAULT if any of the data structures pointed to are invalid. -- * May fail with -EINVAL if aio_context specified by ctx_id is -- * invalid. May fail with -EAGAIN if the iocb specified was not -- * cancelled. Will fail with -ENOSYS if not implemented. -+ * Attempts to cancel an iocb previously passed to io_submit(). If the -+ * operation is successfully cancelled 0 is returned. May fail with -+ * -EFAULT if any of the data structures pointed to are invalid. May -+ * fail with -EINVAL if aio_context specified by ctx_id is invalid. Will -+ * fail with -ENOSYS if not implemented. - */ - SYSCALL_DEFINE3(io_cancel, aio_context_t, ctx_id, struct iocb __user *, iocb, - struct io_event __user *, result) -@@ -2157,14 +2154,12 @@ SYSCALL_DEFINE3(io_cancel, aio_context_t - } - spin_unlock_irq(&ctx->ctx_lock); - -- if (!ret) { -- /* -- * The result argument is no longer used - the io_event is -- * always delivered via the ring buffer. -EINPROGRESS indicates -- * cancellation is progress: -- */ -- ret = -EINPROGRESS; -- } -+ /* -+ * The result argument is no longer used - the io_event is always -+ * delivered via the ring buffer. -+ */ -+ if (ret == 0 && kiocb->rw.ki_flags & IOCB_AIO_RW) -+ aio_complete_rw(&kiocb->rw, -EINTR); - - percpu_ref_put(&ctx->users); - diff --git a/queue-6.6/series b/queue-6.6/series index 0aba8963213..2e0857edc99 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -100,7 +100,6 @@ kbuild-add-wa-fatal-warnings-to-as-instr-invocation.patch iommufd-fix-iopt_access_list_id-overwrite-bug.patch efivarfs-request-at-most-512-bytes-for-variable-names.patch pmdomain-qcom-rpmhpd-fix-enabled_corner-aggregation.patch -fs-aio-make-io_cancel-generate-completions-again.patch mm-debug_vm_pgtable-fix-bug_on-with-pud-advanced-test.patch x86-e820-don-t-reserve-setup_rng_seed-in-e820.patch x86-cpu-intel-detect-tme-keyid-bits-before-setting-mtrr-mask-registers.patch diff --git a/queue-6.7/fs-aio-make-io_cancel-generate-completions-again.patch b/queue-6.7/fs-aio-make-io_cancel-generate-completions-again.patch deleted file mode 100644 index 1969e81c03b..00000000000 --- a/queue-6.7/fs-aio-make-io_cancel-generate-completions-again.patch +++ /dev/null @@ -1,85 +0,0 @@ -From 54cbc058d86beca3515c994039b5c0f0a34f53dd Mon Sep 17 00:00:00 2001 -From: Bart Van Assche -Date: Thu, 15 Feb 2024 12:47:39 -0800 -Subject: fs/aio: Make io_cancel() generate completions again - -From: Bart Van Assche - -commit 54cbc058d86beca3515c994039b5c0f0a34f53dd upstream. - -The following patch accidentally removed the code for delivering -completions for cancelled reads and writes to user space: "[PATCH 04/33] -aio: remove retry-based AIO" -(https://lore.kernel.org/all/1363883754-27966-5-git-send-email-koverstreet@google.com/) ->From that patch: - -- if (kiocbIsCancelled(iocb)) { -- ret = -EINTR; -- aio_complete(iocb, ret, 0); -- /* must not access the iocb after this */ -- goto out; -- } - -This leads to a leak in user space of a struct iocb. Hence this patch -that restores the code that reports to user space that a read or write -has been cancelled successfully. - -Fixes: 41003a7bcfed ("aio: remove retry-based AIO") -Cc: Christoph Hellwig -Cc: Avi Kivity -Cc: Sandeep Dhavale -Cc: Jens Axboe -Cc: Greg Kroah-Hartman -Cc: Kent Overstreet -Cc: stable@vger.kernel.org -Signed-off-by: Bart Van Assche -Link: https://lore.kernel.org/r/20240215204739.2677806-3-bvanassche@acm.org -Signed-off-by: Christian Brauner -Signed-off-by: Greg Kroah-Hartman ---- - fs/aio.c | 27 +++++++++++---------------- - 1 file changed, 11 insertions(+), 16 deletions(-) - ---- a/fs/aio.c -+++ b/fs/aio.c -@@ -2119,14 +2119,11 @@ COMPAT_SYSCALL_DEFINE3(io_submit, compat - #endif - - /* sys_io_cancel: -- * Attempts to cancel an iocb previously passed to io_submit. If -- * the operation is successfully cancelled, the resulting event is -- * copied into the memory pointed to by result without being placed -- * into the completion queue and 0 is returned. May fail with -- * -EFAULT if any of the data structures pointed to are invalid. -- * May fail with -EINVAL if aio_context specified by ctx_id is -- * invalid. May fail with -EAGAIN if the iocb specified was not -- * cancelled. Will fail with -ENOSYS if not implemented. -+ * Attempts to cancel an iocb previously passed to io_submit(). If the -+ * operation is successfully cancelled 0 is returned. May fail with -+ * -EFAULT if any of the data structures pointed to are invalid. May -+ * fail with -EINVAL if aio_context specified by ctx_id is invalid. Will -+ * fail with -ENOSYS if not implemented. - */ - SYSCALL_DEFINE3(io_cancel, aio_context_t, ctx_id, struct iocb __user *, iocb, - struct io_event __user *, result) -@@ -2157,14 +2154,12 @@ SYSCALL_DEFINE3(io_cancel, aio_context_t - } - spin_unlock_irq(&ctx->ctx_lock); - -- if (!ret) { -- /* -- * The result argument is no longer used - the io_event is -- * always delivered via the ring buffer. -EINPROGRESS indicates -- * cancellation is progress: -- */ -- ret = -EINPROGRESS; -- } -+ /* -+ * The result argument is no longer used - the io_event is always -+ * delivered via the ring buffer. -+ */ -+ if (ret == 0 && kiocb->rw.ki_flags & IOCB_AIO_RW) -+ aio_complete_rw(&kiocb->rw, -EINTR); - - percpu_ref_put(&ctx->users); - diff --git a/queue-6.7/series b/queue-6.7/series index 20055bf71d4..1b5a25ca8f1 100644 --- a/queue-6.7/series +++ b/queue-6.7/series @@ -113,7 +113,6 @@ iommufd-fix-protection-fault-in-iommufd_test_syz_conv_iova.patch efivarfs-request-at-most-512-bytes-for-variable-names.patch pmdomain-arm-fix-null-dereference-on-scmi_perf_domain-removal.patch pmdomain-qcom-rpmhpd-fix-enabled_corner-aggregation.patch -fs-aio-make-io_cancel-generate-completions-again.patch fprobe-fix-to-allocate-entry_data_size-buffer-with-rethook-instances.patch mm-debug_vm_pgtable-fix-bug_on-with-pud-advanced-test.patch mm-vmscan-fix-a-bug-calling-wakeup_kswapd-with-a-wrong-zone-index.patch -- 2.47.3