Pull vfs fixes from Christian Brauner: - netfs: - fix the decision when to disallow write-streaming with fscache in use, handling of asynchronous cache object creation, a double fput in cachefiles, clearing S_KERNEL_FILE without the inode lock held, page extraction bugs in the iov_iter helpers (a potential underflow, a missing allocation failure check, a memory leak, and a folio offset miscalculation), writeback error and ENOMEM handling, DIO write retry for filesystems without a ->prepare_write() method, and the replacement of the wb_lock mutex with a bit lock plus writethrough collection offload so that multiple asynchronous writebacks don't interfere with each other. - Fix the barriering when walking the netfs subrequest list during retries as it was possible to see a subrequest that was just added by the application thread. - iomap: - Change iomap to submit read bios after each extent instead of building them up across extents. The old behavior was considered problematic for a while and now caused an actual erofs bug. - Guard the ioend io_size EOF trim in iomap against underflow when a concurrent truncate moves EOF below the start of the ioend, wrapping io_size to a huge value. - overlayfs - Fix a stale overlayfs comment about the locking order. - Store the linked-in upper dentry instead of the disconnected O_TMPFILE dentry during overlayfs tmpfile copy-up. With a FUSE or virtiofs upper layer ->d_revalidate() would try to look up "/" in the workdir and fail, causing persistent ESTALE errors that broke dpkg and apt. - vfs-bpf: Have the bpf_real_data_inode() kfunc take a struct file instead of a dentry so it is usable from the bprm_check_security, mmap_file, and file_mprotect hooks, and rename it from bpf_real_inode() to make the data-inode semantics explicit. The kfunc landed this cycle so the change is safe. - afs: NULL pointer dereferences in the callback service and in afs_get_tree(), several memory and refcount leaks, missing locking around the dynamic root inode numbers and premature cell exposure through /afs, a netns destruction hang caused by a misplaced increment of net->cells_outstanding, a bulk lookup malfunction caused by the dir_emit() API change, inode (re)initialisation issues, and assorted smaller fixes to error codes, seqlock handling, and debug output. - vfs: Refuse O_TMPFILE creation with an unmapped fsuid or fsgid and add a selftest for it. - vboxsf: Add Jori Koolstra as vboxsf maintainer, taking over from Hans de Goede. - dio: Release the pages attached to a short atomic dio bio; the REQ_ATOMIC size check error path leaked them. - procfs: Only bump the parent directory link count when registering directories in procfs. Registering regular files inflated the count and leaked a link on every create and remove cycle. - minix: Avoid an unsigned overflow in the minix bitmap block count calculation that let crafted images with huge inode or zone counts pass superblock validation and crash the kernel during mount. - cachefiles: Fix a double unlock in the cachefiles nomem_d_alloc error path left over from the start_creating() conversion. - fat: Stop fat from reading directory entries past the 0x00 end-of-directory marker. If the trailing on-disk slots aren't zero-filled the driver surfaced arbitrary garbage as directory entries. - freexvfs: Don't BUG() on unknown typed-extent types in freevxfs, reachable via ioctl(FIBMAP) on a crafted image; fail with an I/O error instead. - orangefs: Keep the readdir entry size 64-bit in orangefs fill_from_part(). Truncating it to __u32 bypassed the bounds check and led to out-of-bounds reads triggerable by the userspace client. - xfs: Fix the error unwind in xfs_open_devices() which released the rt device file twice and left dangling buftarg pointers behind that were freed again when the failed mount was torn down. - exec: Fix an off-by-one in the comment documenting the maximum binfmt rewrite depth in exec_binprm(). The code allows five rewrites, not four; restricting the code would break userspace so the comment is fixed instead. - file handles: Reject detached mounts in capable_wrt_mount(). A detached mount can be dissolved concurrently, leaving a NULL mount namespace that open_by_handle_at() would dereference. * tag 'vfs-7.2-rc2.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (57 commits) netfs: Fix barriering when walking subrequest list iomap: submit read bio after each extent fuse: call fuse_send_readpages explicitly from fuse_readahead iomap: consolidate bio submission fhandle: reject detached mounts in capable_wrt_mount() netfs: Fix DIO write retry for filesystems without a ->prepare_write() netfs: Fix folio state after ENOMEM whilst under writeback iteration netfs: Fix writeback error handling netfs: Fix writethrough to use collection offload netfs: Replace wb_lock with a bit lock for asynchronicity netfs: Fix kdoc warning scatterlist: Fix offset in folio calc in extract_xarray_to_sg() iov_iter: Remove unused variable in kunit_iov_iter.c iov_iter: Fix a memory leak in iov_iter_extract_user_pages() iov_iter: Fix missing alloc fail check in iov_iter_extract_bvec_pages() iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages() cachefiles: Fix file burial to take lock when unsetting S_KERNEL_FILE cachefiles: Fix double fput netfs: Fix netfs_create_write_req() to handle async cache object creation netfs: Fix decision whether to disallow write-streaming due to fscache use ...
Showing the changes to include (2 of 52 files). Show all
Unified · Split
| @@ -622,6 +622,8 @@ extern struct bio_set iomap_ioend_bioset; · 621 unmodified lines | |||
| 622 | #ifdef CONFIG_BLOCK | 622 | #ifdef CONFIG_BLOCK |
| 623 | int iomap_bio_read_folio_range(const struct iomap_iter *iter, | 623 | int iomap_bio_read_folio_range(const struct iomap_iter *iter, |
| 624 | struct iomap_read_folio_ctx *ctx, size_t plen); | 624 | struct iomap_read_folio_ctx *ctx, size_t plen); |
| 625 | void iomap_bio_submit_read_endio(const struct iomap_iter *iter, | ||
| 626 | struct iomap_read_folio_ctx *ctx, bio_end_io_t end_io); | ||
| 625 | 627 | ||
| 626 | extern const struct iomap_read_ops iomap_bio_read_ops; | 628 | extern const struct iomap_read_ops iomap_bio_read_ops; |
| 627 | 629 | ||
| @@ -61,14 +61,16 @@ struct netfs_inode { · 60 unmodified lines | |||
| 61 | #if IS_ENABLED(CONFIG_FSCACHE) | 61 | #if IS_ENABLED(CONFIG_FSCACHE) |
| 62 | struct fscache_cookie *cache; | 62 | struct fscache_cookie *cache; |
| 63 | #endif | 63 | #endif |
| 64 | struct mutex wb_lock; /* Writeback serialisation */ | 64 | struct list_head wb_queue; /* Queue of processes wanting to do writeback */ |
| 65 | loff_t _remote_i_size; /* Size of the remote file */ | 65 | loff_t _remote_i_size; /* Size of the remote file */ |
| 66 | loff_t _zero_point; /* Size after which we assume there's no data | 66 | loff_t _zero_point; /* Size after which we assume there's no data |
| 67 | * on the server */ | 67 | * on the server */ |
| 68 | spinlock_t lock; /* Lock covering wb_queue */ | ||
| 68 | atomic_t io_count; /* Number of outstanding reqs */ | 69 | atomic_t io_count; /* Number of outstanding reqs */ |
| 69 | unsigned long flags; | 70 | unsigned long flags; |
| 70 | #define NETFS_ICTX_ODIRECT 0 /* The file has DIO in progress */ | 71 | #define NETFS_ICTX_ODIRECT 0 /* The file has DIO in progress */ |
| 71 | #define NETFS_ICTX_UNBUFFERED 1 /* I/O should not use the pagecache */ | 72 | #define NETFS_ICTX_UNBUFFERED 1 /* I/O should not use the pagecache */ |
| 73 | #define NETFS_ICTX_WB_LOCK 2 /* Writeback serialisation lock */ | ||
| 72 | #define NETFS_ICTX_MODIFIED_ATTR 3 /* Indicate change in mtime/ctime */ | 74 | #define NETFS_ICTX_MODIFIED_ATTR 3 /* Indicate change in mtime/ctime */ |
| 73 | #define NETFS_ICTX_SINGLE_NO_UPLOAD 4 /* Monolithic payload, cache but no upload */ | 75 | #define NETFS_ICTX_SINGLE_NO_UPLOAD 4 /* Monolithic payload, cache but no upload */ |
| 74 | }; | 76 | }; |
| @@ -462,6 +464,10 @@ int netfs_alloc_folioq_buffer(struct address_space *mapping, · 387 unmodified lines | |||
| 462 | size_t *_cur_size, ssize_t size, gfp_t gfp); | 464 | size_t *_cur_size, ssize_t size, gfp_t gfp); |
| 463 | void netfs_free_folioq_buffer(struct folio_queue *fq); | 465 | void netfs_free_folioq_buffer(struct folio_queue *fq); |
| 464 | 466 | ||
| 467 | /* Writeback exclusion API. */ | ||
| 468 | bool netfs_wb_begin(struct netfs_inode *ictx, bool nowait); | ||
| 469 | void netfs_wb_end(struct netfs_inode *ictx); | ||
| 470 | |||
| 465 | /** | 471 | /** |
| 466 | * netfs_inode - Get the netfs inode context from the inode | 472 | * netfs_inode - Get the netfs inode context from the inode |
| 467 | * @inode: The inode to query | 473 | * @inode: The inode to query |
| @@ -743,7 +749,8 @@ static inline void netfs_inode_init(struct netfs_inode *ctx, · 275 unmodified lines | |||
| 743 | #if IS_ENABLED(CONFIG_FSCACHE) | 749 | #if IS_ENABLED(CONFIG_FSCACHE) |
| 744 | ctx->cache = NULL; | 750 | ctx->cache = NULL; |
| 745 | #endif | 751 | #endif |
| 746 | mutex_init(&ctx->wb_lock); | 752 | INIT_LIST_HEAD(&ctx->wb_queue); |
| 753 | spin_lock_init(&ctx->lock); | ||
| 747 | /* ->releasepage() drives zero_point */ | 754 | /* ->releasepage() drives zero_point */ |
| 748 | if (use_zero_point) { | 755 | if (use_zero_point) { |
| 749 | ctx->_zero_point = ctx->_remote_i_size; | 756 | ctx->_zero_point = ctx->_remote_i_size; |
| @@ -753,7 +760,7 @@ static inline void netfs_inode_init(struct netfs_inode *ctx, · 3 unmodified lines | |||
| 753 | 760 | ||
| 754 | /** | 761 | /** |
| 755 | * netfs_resize_file - Note that a file got resized | 762 | * netfs_resize_file - Note that a file got resized |
| 756 | * @ctx: The netfs inode being resized | 763 | * @ictx: The netfs inode being resized |
| 757 | * @new_i_size: The new file size | 764 | * @new_i_size: The new file size |
| 758 | * @changed_on_server: The change was applied to the server | 765 | * @changed_on_server: The change was applied to the server |
| 759 | * | 766 | * |