fs/netfs/read_collect: add to next->prev_donated

If multiple subrequests donate data to the same "next" request
(depending on the subrequest completion order), each of them would
overwrite the `prev_donated` field, causing data corruption and a
BUG() crash ("Can't donate prior to front").

Fixes: ee4cdf7ba857 ("netfs: Speed up buffered reading")
Closes: https://lore.kernel.org/netfs/CAKPOu+_4mUwYgQtRTbXCmi+-k3PGvLysnPadkmHOyB7Gz0iSMA@mail.gmail.com/
Cc: stable@vger.kernel.org
Signed-off-by: Max Kellermann <max.kellermann@ionos.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/netfs/read_collect.c b/fs/netfs/read_collect.c
index 3b9461f5e712e5c7b5156c3408694913ac667d49..eae415efae24a020c8ff6400e0be3fb7706d6bb5 100644 (file)
--- a/fs/netfs/read_collect.c
+++ b/fs/netfs/read_collect.c
@@ -284,7 +284,7 @@ donation_changed:
                                   netfs_trace_donate_to_deferred_next);
        } else {
                next = list_next_entry(subreq, rreq_link);
-               WRITE_ONCE(next->prev_donated, excess);
+               WRITE_ONCE(next->prev_donated, next->prev_donated + excess);
                trace_netfs_donate(rreq, subreq, next, excess,
                                   netfs_trace_donate_to_next);
        }