Skip to content

Commit dd78e42

Browse files
committed
Merge: CVE-2024-57941: netfs: Fix the (non-)cancellation of copy when cache is temporarily disabled
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/239 JIRA: https://issues.redhat.com/browse/RHEL-75660 CVE: CVE-2024-57941 ``` netfs: Fix the (non-)cancellation of copy when cache is temporarily disabled When the caching for a cookie is temporarily disabled (e.g. due to a DIO write on that file), future copying to the cache for that file is disabled until all fds open on that file are closed. However, if netfslib is using the deprecated PG_private_2 method (such as is currently used by ceph), and decides it wants to copy to the cache, netfs_advance_write() will just bail at the first check seeing that the cache stream is unavailable, and indicate that it dealt with all the content. This means that we have no subrequests to provide notifications to drive the state machine or even to pin the request and the request just gets discarded, leaving the folios with PG_private_2 set. Fix this by jumping directly to cancel the request if the cache is not available. That way, we don't remove mark3 from the folio_queue list and netfs_pgpriv2_cancel() will clean up the folios. This was found by running the generic/013 xfstest against ceph with an active cache and the "-o fsc" option passed to ceph. That would usually hang Fixes: ee4cdf7 ("netfs: Speed up buffered reading") Reported-by: Max Kellermann <max.kellermann@ionos.com> Closes: https://lore.kernel.org/r/CAKPOu+_4m80thNy5_fvROoxBm689YtA0dZ-=gcmkzwYSY4syqw@mail.gmail.com/ Signed-off-by: David Howells <dhowells@redhat.com> Link: https://lore.kernel.org/r/20241213135013.2964079-11-dhowells@redhat.com cc: Jeff Layton <jlayton@kernel.org> cc: Ilya Dryomov <idryomov@gmail.com> cc: Xiubo Li <xiubli@redhat.com> cc: netfs@lists.linux.dev cc: ceph-devel@vger.kernel.org cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner <brauner@kernel.org> (cherry picked from commit d0327c8) ``` Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com> --- <small>Created 2025-01-21 17:11 UTC by backporter - [KWF FAQ](https://red.ht/kernel_workflow_doc) - [Slack #team-kernel-workflow](https://redhat-internal.slack.com/archives/C04LRUPMJQ5) - [Source](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/webhook/utils/backporter.py) - [Documentation](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/docs/README.backporter.md) - [Report an issue](https://gitlab.com/cki-project/kernel-workflow/-/issues/new?issue%5Btitle%5D=backporter%20webhook%20issue)</small> Approved-by: David Howells <dhowells@redhat.com> Approved-by: Paulo Alcantara <paalcant@redhat.com> Approved-by: Benjamin Coddington <bcodding@redhat.com> Approved-by: Alex Markuze <amarkuze@redhat.com> Merged-by: Julio Faracco <jfaracco@redhat.com>
2 parents 05b5232 + 6680a53 commit dd78e42

File tree

1 file changed

+4
-0
lines changed

1 file changed

+4
-0
lines changed

fs/netfs/read_pgpriv2.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -170,6 +170,10 @@ void netfs_pgpriv2_write_to_the_cache(struct netfs_io_request *rreq)
170170

171171
trace_netfs_write(wreq, netfs_write_trace_copy_to_cache);
172172
netfs_stat(&netfs_n_wh_copy_to_cache);
173+
if (!wreq->io_streams[1].avail) {
174+
netfs_put_request(wreq, false, netfs_rreq_trace_put_return);
175+
goto couldnt_start;
176+
}
173177

174178
for (;;) {
175179
error = netfs_pgpriv2_copy_folio(wreq, folio);

0 commit comments

Comments
 (0)