tmakin/ack-tegra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fs/netfs/read_collect: add to next->prev_donated

Browse Source 
If multiple subrequests donate data to the same "next" request
(depending on the subrequest completion order), each of them would
overwrite the `prev_donated` field, causing data corruption and a
BUG() crash ("Can't donate prior to front").

Fixes: ee4cdf7ba8 ("netfs: Speed up buffered reading")
Closes: https://lore.kernel.org/netfs/CAKPOu+_4mUwYgQtRTbXCmi+-k3PGvLysnPadkmHOyB7Gz0iSMA@mail.gmail.com/
Cc: stable@vger.kernel.org
Signed-off-by: Max Kellermann <max.kellermann@ionos.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Max Kellermann
2025-02-20 16:24:50 +01:00
committed by Greg Kroah-Hartman
parent 8f324d9930
commit 62b9ad7e52
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fs/netfs/read_collect.c
+1 -1
View File
@@ -284,7 +284,7 @@ donation_changed:
netfs_trace_donate_to_deferred_next); netfs_trace_donate_to_deferred_next);
} else { } else {
next = list_next_entry(subreq, rreq_link); next = list_next_entry(subreq, rreq_link);
WRITE_ONCE(next->prev_donated, excess); WRITE_ONCE(next->prev_donated, next->prev_donated + excess);
trace_netfs_donate(rreq, subreq, next, excess, trace_netfs_donate(rreq, subreq, next, excess,
netfs_trace_donate_to_next); netfs_trace_donate_to_next);
} }