This is a note to let you know that I've just added the patch titled
afs: Fix the maths in afs_fs_store_data()
to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
afs-fix-the-maths-in-afs_fs_store_data.patch
and it can be found in the queue-3.18 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> …
[View More]know about it.
>From foo@baz Mon Dec 18 15:03:25 CET 2017
From: David Howells <dhowells(a)redhat.com>
Date: Thu, 16 Mar 2017 16:27:47 +0000
Subject: afs: Fix the maths in afs_fs_store_data()
From: David Howells <dhowells(a)redhat.com>
[ Upstream commit 146a1192783697810b63a1e41c4d59fc93387340 ]
afs_fs_store_data() works out of the size of the write it's going to make,
but it uses 32-bit unsigned subtraction in one place that gets
automatically cast to loff_t.
However, if to < offset, then the number goes negative, but as the result
isn't signed, this doesn't get sign-extended to 64-bits when placed in a
loff_t.
Fix by casting the operands to loff_t.
Signed-off-by: David Howells <dhowells(a)redhat.com>
Signed-off-by: Sasha Levin <alexander.levin(a)verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
fs/afs/fsclient.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/afs/fsclient.c
+++ b/fs/afs/fsclient.c
@@ -1225,7 +1225,7 @@ int afs_fs_store_data(struct afs_server
_enter(",%x,{%x:%u},,",
key_serial(wb->key), vnode->fid.vid, vnode->fid.vnode);
- size = to - offset;
+ size = (loff_t)to - (loff_t)offset;
if (first != last)
size += (loff_t)(last - first) << PAGE_SHIFT;
pos = (loff_t)first << PAGE_SHIFT;
Patches currently in stable-queue which might be from dhowells(a)redhat.com are
queue-3.18/afs-flush-outstanding-writes-when-an-fd-is-closed.patch
queue-3.18/afs-fix-the-maths-in-afs_fs_store_data.patch
queue-3.18/keys-don-t-permit-request_key-to-construct-a-new-keyring.patch
queue-3.18/afs-populate-group-id-from-vnode-status.patch
queue-3.18/afs-adjust-mode-bits-processing.patch
queue-3.18/afs-fix-page-leak-in-afs_write_begin.patch
queue-3.18/afs-fix-missing-put_page.patch
queue-3.18/afs-populate-and-use-client-modification-time.patch
queue-3.18/afs-fix-afs_kill_pages.patch
queue-3.18/don-t-leak-a-key-reference-if-request_key-tries-to-use-a-revoked-keyring.patch
[View Less]
This is a note to let you know that I've just added the patch titled
afs: Fix page leak in afs_write_begin()
to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
afs-fix-page-leak-in-afs_write_begin.patch
and it can be found in the queue-3.18 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know …
[View More]about it.
>From foo@baz Mon Dec 18 15:03:25 CET 2017
From: David Howells <dhowells(a)redhat.com>
Date: Thu, 16 Mar 2017 16:27:48 +0000
Subject: afs: Fix page leak in afs_write_begin()
From: David Howells <dhowells(a)redhat.com>
[ Upstream commit 6d06b0d25209c80e99c1e89700f1e09694a3766b ]
afs_write_begin() leaks a ref and a lock on a page if afs_fill_page()
fails. Fix the leak by unlocking and releasing the page in the error path.
Signed-off-by: David Howells <dhowells(a)redhat.com>
Signed-off-by: Sasha Levin <alexander.levin(a)verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
fs/afs/write.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/fs/afs/write.c
+++ b/fs/afs/write.c
@@ -149,12 +149,12 @@ int afs_write_begin(struct file *file, s
kfree(candidate);
return -ENOMEM;
}
- *pagep = page;
- /* page won't leak in error case: it eventually gets cleaned off LRU */
if (!PageUptodate(page) && len != PAGE_CACHE_SIZE) {
ret = afs_fill_page(vnode, key, index << PAGE_CACHE_SHIFT, page);
if (ret < 0) {
+ unlock_page(page);
+ put_page(page);
kfree(candidate);
_leave(" = %d [prep]", ret);
return ret;
@@ -162,6 +162,9 @@ int afs_write_begin(struct file *file, s
SetPageUptodate(page);
}
+ /* page won't leak in error case: it eventually gets cleaned off LRU */
+ *pagep = page;
+
try_again:
spin_lock(&vnode->writeback_lock);
Patches currently in stable-queue which might be from dhowells(a)redhat.com are
queue-3.18/afs-flush-outstanding-writes-when-an-fd-is-closed.patch
queue-3.18/afs-fix-the-maths-in-afs_fs_store_data.patch
queue-3.18/keys-don-t-permit-request_key-to-construct-a-new-keyring.patch
queue-3.18/afs-populate-group-id-from-vnode-status.patch
queue-3.18/afs-adjust-mode-bits-processing.patch
queue-3.18/afs-fix-page-leak-in-afs_write_begin.patch
queue-3.18/afs-fix-missing-put_page.patch
queue-3.18/afs-populate-and-use-client-modification-time.patch
queue-3.18/afs-fix-afs_kill_pages.patch
queue-3.18/don-t-leak-a-key-reference-if-request_key-tries-to-use-a-revoked-keyring.patch
[View Less]
This is a note to let you know that I've just added the patch titled
afs: Fix afs_kill_pages()
to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
afs-fix-afs_kill_pages.patch
and it can be found in the queue-3.18 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From foo@baz …
[View More]Mon Dec 18 15:03:25 CET 2017
From: David Howells <dhowells(a)redhat.com>
Date: Thu, 16 Mar 2017 16:27:48 +0000
Subject: afs: Fix afs_kill_pages()
From: David Howells <dhowells(a)redhat.com>
[ Upstream commit 7286a35e893176169b09715096a4aca557e2ccd2 ]
Fix afs_kill_pages() in two ways:
(1) If a writeback has been partially flushed, then if we try and kill the
pages it contains, some of them may no longer be undergoing writeback
and end_page_writeback() will assert.
Fix this by checking to see whether the page in question is actually
undergoing writeback before ending that writeback.
(2) The loop that scans for pages to kill doesn't increase the first page
index, and so the loop may not terminate, but it will try to process
the same pages over and over again.
Fix this by increasing the first page index to one after the last page
we processed.
Signed-off-by: David Howells <dhowells(a)redhat.com>
Signed-off-by: Sasha Levin <alexander.levin(a)verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
fs/afs/write.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
--- a/fs/afs/write.c
+++ b/fs/afs/write.c
@@ -300,10 +300,14 @@ static void afs_kill_pages(struct afs_vn
ASSERTCMP(pv.nr, ==, count);
for (loop = 0; loop < count; loop++) {
- ClearPageUptodate(pv.pages[loop]);
+ struct page *page = pv.pages[loop];
+ ClearPageUptodate(page);
if (error)
- SetPageError(pv.pages[loop]);
- end_page_writeback(pv.pages[loop]);
+ SetPageError(page);
+ if (PageWriteback(page))
+ end_page_writeback(page);
+ if (page->index >= first)
+ first = page->index + 1;
}
__pagevec_release(&pv);
Patches currently in stable-queue which might be from dhowells(a)redhat.com are
queue-3.18/afs-flush-outstanding-writes-when-an-fd-is-closed.patch
queue-3.18/afs-fix-the-maths-in-afs_fs_store_data.patch
queue-3.18/keys-don-t-permit-request_key-to-construct-a-new-keyring.patch
queue-3.18/afs-populate-group-id-from-vnode-status.patch
queue-3.18/afs-adjust-mode-bits-processing.patch
queue-3.18/afs-fix-page-leak-in-afs_write_begin.patch
queue-3.18/afs-fix-missing-put_page.patch
queue-3.18/afs-populate-and-use-client-modification-time.patch
queue-3.18/afs-fix-afs_kill_pages.patch
queue-3.18/don-t-leak-a-key-reference-if-request_key-tries-to-use-a-revoked-keyring.patch
[View Less]
This is a note to let you know that I've just added the patch titled
afs: Fix missing put_page()
to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
afs-fix-missing-put_page.patch
and it can be found in the queue-3.18 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From foo@…
[View More]baz Mon Dec 18 15:03:25 CET 2017
From: David Howells <dhowells(a)redhat.com>
Date: Thu, 16 Mar 2017 16:27:43 +0000
Subject: afs: Fix missing put_page()
From: David Howells <dhowells(a)redhat.com>
[ Upstream commit 29c8bbbd6e21daa0997d1c3ee886b897ee7ad652 ]
In afs_writepages_region(), inside the loop where we find dirty pages to
deal with, one of the if-statements is missing a put_page().
Signed-off-by: David Howells <dhowells(a)redhat.com>
Signed-off-by: Sasha Levin <alexander.levin(a)verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
fs/afs/write.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/afs/write.c
+++ b/fs/afs/write.c
@@ -504,6 +504,7 @@ static int afs_writepages_region(struct
if (PageWriteback(page) || !PageDirty(page)) {
unlock_page(page);
+ put_page(page);
continue;
}
Patches currently in stable-queue which might be from dhowells(a)redhat.com are
queue-3.18/afs-flush-outstanding-writes-when-an-fd-is-closed.patch
queue-3.18/afs-fix-the-maths-in-afs_fs_store_data.patch
queue-3.18/keys-don-t-permit-request_key-to-construct-a-new-keyring.patch
queue-3.18/afs-populate-group-id-from-vnode-status.patch
queue-3.18/afs-adjust-mode-bits-processing.patch
queue-3.18/afs-fix-page-leak-in-afs_write_begin.patch
queue-3.18/afs-fix-missing-put_page.patch
queue-3.18/afs-populate-and-use-client-modification-time.patch
queue-3.18/afs-fix-afs_kill_pages.patch
queue-3.18/don-t-leak-a-key-reference-if-request_key-tries-to-use-a-revoked-keyring.patch
[View Less]
This is a note to let you know that I've just added the patch titled
afs: Adjust mode bits processing
to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
afs-adjust-mode-bits-processing.patch
and it can be found in the queue-3.18 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
&…
[View More]gt;From foo@baz Mon Dec 18 15:03:25 CET 2017
From: Marc Dionne <marc.dionne(a)auristor.com>
Date: Thu, 16 Mar 2017 16:27:44 +0000
Subject: afs: Adjust mode bits processing
From: Marc Dionne <marc.dionne(a)auristor.com>
[ Upstream commit 627f46943ff90bcc32ddeb675d881c043c6fa2ae ]
Mode bits for an afs file should not be enforced in the usual
way.
For files, the absence of user bits can restrict file access
with respect to what is granted by the server.
These bits apply regardless of the owner or the current uid; the
rest of the mode bits (group, other) are ignored.
Signed-off-by: Marc Dionne <marc.dionne(a)auristor.com>
Signed-off-by: David Howells <dhowells(a)redhat.com>
Signed-off-by: Sasha Levin <alexander.levin(a)verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
fs/afs/security.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/fs/afs/security.c
+++ b/fs/afs/security.c
@@ -340,17 +340,22 @@ int afs_permission(struct inode *inode,
} else {
if (!(access & AFS_ACE_LOOKUP))
goto permission_denied;
+ if ((mask & MAY_EXEC) && !(inode->i_mode & S_IXUSR))
+ goto permission_denied;
if (mask & (MAY_EXEC | MAY_READ)) {
if (!(access & AFS_ACE_READ))
goto permission_denied;
+ if (!(inode->i_mode & S_IRUSR))
+ goto permission_denied;
} else if (mask & MAY_WRITE) {
if (!(access & AFS_ACE_WRITE))
goto permission_denied;
+ if (!(inode->i_mode & S_IWUSR))
+ goto permission_denied;
}
}
key_put(key);
- ret = generic_permission(inode, mask);
_leave(" = %d", ret);
return ret;
Patches currently in stable-queue which might be from marc.dionne(a)auristor.com are
queue-3.18/afs-populate-group-id-from-vnode-status.patch
queue-3.18/afs-adjust-mode-bits-processing.patch
queue-3.18/afs-populate-and-use-client-modification-time.patch
[View Less]
This is a note to let you know that I've just added the patch titled
xfs: fix log block underflow during recovery cycle verification
to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
xfs-fix-log-block-underflow-during-recovery-cycle-verification.patch
and it can be found in the queue-4.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
…
[View More]please let <stable(a)vger.kernel.org> know about it.
>From foo@baz Mon Dec 18 14:47:43 CET 2017
From: Brian Foster <bfoster(a)redhat.com>
Date: Thu, 26 Oct 2017 09:31:16 -0700
Subject: xfs: fix log block underflow during recovery cycle verification
From: Brian Foster <bfoster(a)redhat.com>
[ Upstream commit 9f2a4505800607e537e9dd9dea4f55c4b0c30c7a ]
It is possible for mkfs to format very small filesystems with too
small of an internal log with respect to the various minimum size
and block count requirements. If this occurs when the log happens to
be smaller than the scan window used for cycle verification and the
scan wraps the end of the log, the start_blk calculation in
xlog_find_head() underflows and leads to an attempt to scan an
invalid range of log blocks. This results in log recovery failure
and a failed mount.
Since there may be filesystems out in the wild with this kind of
geometry, we cannot simply refuse to mount. Instead, cap the scan
window for cycle verification to the size of the physical log. This
ensures that the cycle verification proceeds as expected when the
scan wraps the end of the log.
Reported-by: Zorro Lang <zlang(a)redhat.com>
Signed-off-by: Brian Foster <bfoster(a)redhat.com>
Reviewed-by: Darrick J. Wong <darrick.wong(a)oracle.com>
Signed-off-by: Darrick J. Wong <darrick.wong(a)oracle.com>
Signed-off-by: Sasha Levin <alexander.levin(a)verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
fs/xfs/xfs_log_recover.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -738,7 +738,7 @@ xlog_find_head(
* in the in-core log. The following number can be made tighter if
* we actually look at the block size of the filesystem.
*/
- num_scan_bblks = XLOG_TOTAL_REC_SHIFT(log);
+ num_scan_bblks = min_t(int, log_bbnum, XLOG_TOTAL_REC_SHIFT(log));
if (head_blk >= num_scan_bblks) {
/*
* We are guaranteed that the entire check can be performed
Patches currently in stable-queue which might be from bfoster(a)redhat.com are
queue-4.4/xfs-fix-incorrect-extent-state-in-xfs_bmap_add_extent_unwritten_real.patch
queue-4.4/xfs-fix-log-block-underflow-during-recovery-cycle-verification.patch
[View Less]
This is a note to let you know that I've just added the patch titled
xfs: fix incorrect extent state in xfs_bmap_add_extent_unwritten_real
to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
xfs-fix-incorrect-extent-state-in-xfs_bmap_add_extent_unwritten_real.patch
and it can be found in the queue-4.4 subdirectory.
If you, or anyone else, feels it should not be added to the …
[View More]stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From foo@baz Mon Dec 18 14:47:43 CET 2017
From: Christoph Hellwig <hch(a)lst.de>
Date: Tue, 17 Oct 2017 14:16:19 -0700
Subject: xfs: fix incorrect extent state in xfs_bmap_add_extent_unwritten_real
From: Christoph Hellwig <hch(a)lst.de>
[ Upstream commit 5e422f5e4fd71d18bc6b851eeb3864477b3d842e ]
There was one spot in xfs_bmap_add_extent_unwritten_real that didn't use the
passed in new extent state but always converted to normal, leading to wrong
behavior when converting from normal to unwritten.
Only found by code inspection, it seems like this code path to move partial
extent from written to unwritten while merging it with the next extent is
rarely exercised.
Signed-off-by: Christoph Hellwig <hch(a)lst.de>
Reviewed-by: Brian Foster <bfoster(a)redhat.com>
Reviewed-by: Darrick J. Wong <darrick.wong(a)oracle.com>
Signed-off-by: Darrick J. Wong <darrick.wong(a)oracle.com>
Signed-off-by: Sasha Levin <alexander.levin(a)verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
fs/xfs/libxfs/xfs_bmap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/xfs/libxfs/xfs_bmap.c
+++ b/fs/xfs/libxfs/xfs_bmap.c
@@ -2670,7 +2670,7 @@ xfs_bmap_add_extent_unwritten_real(
&i)))
goto done;
XFS_WANT_CORRUPTED_GOTO(mp, i == 0, done);
- cur->bc_rec.b.br_state = XFS_EXT_NORM;
+ cur->bc_rec.b.br_state = new->br_state;
if ((error = xfs_btree_insert(cur, &i)))
goto done;
XFS_WANT_CORRUPTED_GOTO(mp, i == 1, done);
Patches currently in stable-queue which might be from hch(a)lst.de are
queue-4.4/xfs-fix-incorrect-extent-state-in-xfs_bmap_add_extent_unwritten_real.patch
queue-4.4/target-iscsi-fix-a-race-condition-in-iscsit_add_reject_from_cmd.patch
[View Less]
This is a note to let you know that I've just added the patch titled
writeback: fix memory leak in wb_queue_work()
to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
writeback-fix-memory-leak-in-wb_queue_work.patch
and it can be found in the queue-4.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org&…
[View More]gt; know about it.
>From foo@baz Mon Dec 18 14:47:43 CET 2017
From: Tahsin Erdogan <tahsin(a)google.com>
Date: Fri, 10 Mar 2017 12:09:49 -0800
Subject: writeback: fix memory leak in wb_queue_work()
From: Tahsin Erdogan <tahsin(a)google.com>
[ Upstream commit 4a3a485b1ed0e109718cc8c9d094fa0f552de9b2 ]
When WB_registered flag is not set, wb_queue_work() skips queuing the
work, but does not perform the necessary clean up. In particular, if
work->auto_free is true, it should free the memory.
The leak condition can be reprouced by following these steps:
mount /dev/sdb /mnt/sdb
/* In qemu console: device_del sdb */
umount /dev/sdb
Above will result in a wb_queue_work() call on an unregistered wb and
thus leak memory.
Reported-by: John Sperbeck <jsperbeck(a)google.com>
Signed-off-by: Tahsin Erdogan <tahsin(a)google.com>
Reviewed-by: Jan Kara <jack(a)suse.cz>
Signed-off-by: Jens Axboe <axboe(a)fb.com>
Signed-off-by: Sasha Levin <alexander.levin(a)verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
fs/fs-writeback.c | 35 +++++++++++++++++++++--------------
1 file changed, 21 insertions(+), 14 deletions(-)
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -173,19 +173,33 @@ static void wb_wakeup(struct bdi_writeba
spin_unlock_bh(&wb->work_lock);
}
+static void finish_writeback_work(struct bdi_writeback *wb,
+ struct wb_writeback_work *work)
+{
+ struct wb_completion *done = work->done;
+
+ if (work->auto_free)
+ kfree(work);
+ if (done && atomic_dec_and_test(&done->cnt))
+ wake_up_all(&wb->bdi->wb_waitq);
+}
+
static void wb_queue_work(struct bdi_writeback *wb,
struct wb_writeback_work *work)
{
trace_writeback_queue(wb, work);
- spin_lock_bh(&wb->work_lock);
- if (!test_bit(WB_registered, &wb->state))
- goto out_unlock;
if (work->done)
atomic_inc(&work->done->cnt);
- list_add_tail(&work->list, &wb->work_list);
- mod_delayed_work(bdi_wq, &wb->dwork, 0);
-out_unlock:
+
+ spin_lock_bh(&wb->work_lock);
+
+ if (test_bit(WB_registered, &wb->state)) {
+ list_add_tail(&work->list, &wb->work_list);
+ mod_delayed_work(bdi_wq, &wb->dwork, 0);
+ } else
+ finish_writeback_work(wb, work);
+
spin_unlock_bh(&wb->work_lock);
}
@@ -1839,16 +1853,9 @@ static long wb_do_writeback(struct bdi_w
set_bit(WB_writeback_running, &wb->state);
while ((work = get_next_work_item(wb)) != NULL) {
- struct wb_completion *done = work->done;
-
trace_writeback_exec(wb, work);
-
wrote += wb_writeback(wb, work);
-
- if (work->auto_free)
- kfree(work);
- if (done && atomic_dec_and_test(&done->cnt))
- wake_up_all(&wb->bdi->wb_waitq);
+ finish_writeback_work(wb, work);
}
/*
Patches currently in stable-queue which might be from tahsin(a)google.com are
queue-4.4/writeback-fix-memory-leak-in-wb_queue_work.patch
[View Less]