Commit d8743676 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'vfs-6.17-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs 

Pull vfs fixes from Christian Brauner:

 - Prevent double unlock in netfs

 - Fix a NULL pointer dereference in afs_put_server()

 - Fix a reference leak in netfs

* tag 'vfs-6.17-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  netfs: fix reference leak
  afs: Fix potential null pointer dereference in afs_put_server
  netfs: Prevent duplicate unlocking
parents 0d97ef77 4d428dca

fs/afs/server.c

+2 −1
Original line number Diff line number Diff line
@@ -331,13 +331,14 @@ struct afs_server *afs_use_server(struct afs_server *server, bool activate, 
void afs_put_server(struct afs_net *net, struct afs_server *server,

		    enum afs_server_trace reason)

{

	unsigned int a, debug_id = server->debug_id;

	unsigned int a, debug_id;

	bool zero;

	int r;



	if (!server)

		return;



	debug_id = server->debug_id;

	a = atomic_read(&server->active);

	zero = __refcount_dec_and_test(&server->ref, &r);

	trace_afs_server(debug_id, r - 1, a, reason);

fs/netfs/buffered_read.c

+5 −5
Original line number Diff line number Diff line
@@ -369,7 +369,7 @@ void netfs_readahead(struct readahead_control *ractl) 
	return netfs_put_request(rreq, netfs_rreq_trace_put_return);



cleanup_free:

	return netfs_put_request(rreq, netfs_rreq_trace_put_failed);

	return netfs_put_failed_request(rreq);

}

EXPORT_SYMBOL(netfs_readahead);
@@ -472,7 +472,7 @@ static int netfs_read_gaps(struct file *file, struct folio *folio) 
	return ret < 0 ? ret : 0;



discard:

	netfs_put_request(rreq, netfs_rreq_trace_put_discard);

	netfs_put_failed_request(rreq);

alloc_error:

	folio_unlock(folio);

	return ret;
@@ -532,7 +532,7 @@ int netfs_read_folio(struct file *file, struct folio *folio) 
	return ret < 0 ? ret : 0;



discard:

	netfs_put_request(rreq, netfs_rreq_trace_put_discard);

	netfs_put_failed_request(rreq);

alloc_error:

	folio_unlock(folio);

	return ret;
@@ -699,7 +699,7 @@ int netfs_write_begin(struct netfs_inode *ctx, 
	return 0;



error_put:

	netfs_put_request(rreq, netfs_rreq_trace_put_failed);

	netfs_put_failed_request(rreq);

error:

	if (folio) {

		folio_unlock(folio);
@@ -754,7 +754,7 @@ int netfs_prefetch_for_write(struct file *file, struct folio *folio, 
	return ret < 0 ? ret : 0;



error_put:

	netfs_put_request(rreq, netfs_rreq_trace_put_discard);

	netfs_put_failed_request(rreq);

error:

	_leave(" = %d", ret);

	return ret;

fs/netfs/buffered_write.c

+1 −1
Original line number Diff line number Diff line
@@ -347,7 +347,7 @@ ssize_t netfs_perform_write(struct kiocb *iocb, struct iov_iter *iter, 
		folio_put(folio);

		ret = filemap_write_and_wait_range(mapping, fpos, fpos + flen - 1);

		if (ret < 0)

			goto error_folio_unlock;

			goto out;

		continue;



	copied:

fs/netfs/direct_read.c

+6 −1
Original line number Diff line number Diff line
@@ -131,6 +131,7 @@ static ssize_t netfs_unbuffered_read(struct netfs_io_request *rreq, bool sync) 


	if (rreq->len == 0) {

		pr_err("Zero-sized read [R=%x]\n", rreq->debug_id);

		netfs_put_request(rreq, netfs_rreq_trace_put_discard);

		return -EIO;

	}
@@ -205,7 +206,7 @@ ssize_t netfs_unbuffered_read_iter_locked(struct kiocb *iocb, struct iov_iter *i 
	if (user_backed_iter(iter)) {

		ret = netfs_extract_user_iter(iter, rreq->len, &rreq->buffer.iter, 0);

		if (ret < 0)

			goto out;

			goto error_put;

		rreq->direct_bv = (struct bio_vec *)rreq->buffer.iter.bvec;

		rreq->direct_bv_count = ret;

		rreq->direct_bv_unpin = iov_iter_extract_will_pin(iter);
@@ -238,6 +239,10 @@ ssize_t netfs_unbuffered_read_iter_locked(struct kiocb *iocb, struct iov_iter *i 
	if (ret > 0)

		orig_count -= ret;

	return ret;



error_put:

	netfs_put_failed_request(rreq);

	return ret;

}

EXPORT_SYMBOL(netfs_unbuffered_read_iter_locked);

fs/netfs/direct_write.c

+5 −1
Original line number Diff line number Diff line
@@ -57,7 +57,7 @@ ssize_t netfs_unbuffered_write_iter_locked(struct kiocb *iocb, struct iov_iter * 
			n = netfs_extract_user_iter(iter, len, &wreq->buffer.iter, 0);

			if (n < 0) {

				ret = n;

				goto out;

				goto error_put;

			}

			wreq->direct_bv = (struct bio_vec *)wreq->buffer.iter.bvec;

			wreq->direct_bv_count = n;
@@ -101,6 +101,10 @@ ssize_t netfs_unbuffered_write_iter_locked(struct kiocb *iocb, struct iov_iter * 
out:

	netfs_put_request(wreq, netfs_rreq_trace_put_return);

	return ret;



error_put:

	netfs_put_failed_request(wreq);

	return ret;

}

EXPORT_SYMBOL(netfs_unbuffered_write_iter_locked);