This is a note to let you know that I've just added the patch titled
SUNRPC: Reinitialise the backchannel request buffers before reuse
to the 5.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
sunrpc-reinitialise-the-backchannel-request-buffers-before-reuse.patch
and it can be found in the queue-5.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 6622e3a73112fc336c1c2c582428fb5ef18e456a Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust@xxxxxxxxxxxxxxx>
Date: Wed, 27 Jul 2022 12:27:54 -0400
Subject: SUNRPC: Reinitialise the backchannel request buffers before reuse
From: Trond Myklebust <trond.myklebust@xxxxxxxxxxxxxxx>
commit 6622e3a73112fc336c1c2c582428fb5ef18e456a upstream.
When we're reusing the backchannel requests instead of freeing them,
then we should reinitialise any values of the send/receive xdr_bufs so
that they reflect the available space.
Fixes: 0d2a970d0ae5 ("SUNRPC: Fix a backchannel race")
Signed-off-by: Trond Myklebust <trond.myklebust@xxxxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/sunrpc/backchannel_rqst.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
--- a/net/sunrpc/backchannel_rqst.c
+++ b/net/sunrpc/backchannel_rqst.c
@@ -64,6 +64,17 @@ static void xprt_free_allocation(struct
kfree(req);
}
+static void xprt_bc_reinit_xdr_buf(struct xdr_buf *buf)
+{
+ buf->head[0].iov_len = PAGE_SIZE;
+ buf->tail[0].iov_len = 0;
+ buf->pages = NULL;
+ buf->page_len = 0;
+ buf->flags = 0;
+ buf->len = 0;
+ buf->buflen = PAGE_SIZE;
+}
+
static int xprt_alloc_xdr_buf(struct xdr_buf *buf, gfp_t gfp_flags)
{
struct page *page;
@@ -292,6 +303,9 @@ void xprt_free_bc_rqst(struct rpc_rqst *
*/
spin_lock_bh(&xprt->bc_pa_lock);
if (xprt_need_to_requeue(xprt)) {
+ xprt_bc_reinit_xdr_buf(&req->rq_snd_buf);
+ xprt_bc_reinit_xdr_buf(&req->rq_rcv_buf);
+ req->rq_rcv_buf.len = PAGE_SIZE;
list_add_tail(&req->rq_bc_pa_list, &xprt->bc_pa_list);
xprt->bc_alloc_count++;
atomic_inc(&xprt->bc_slot_count);
Patches currently in stable-queue which might be from trond.myklebust@xxxxxxxxxxxxxxx are
queue-5.15/nfsv4-pnfs-fix-a-use-after-free-bug-in-open.patch
queue-5.15/nfsv4.1-handle-nfs4err_delay-replies-to-op_sequence-correctly.patch
queue-5.15/nfsv4.1-don-t-decrease-the-value-of-seq_nr_highest_sent.patch
queue-5.15/nfsv4.1-reclaim_complete-must-handle-eacces.patch
queue-5.15/sunrpc-reinitialise-the-backchannel-request-buffers-before-reuse.patch
queue-5.15/sunrpc-fix-expiry-of-auth-creds.patch
queue-5.15/nfsv4-fix-races-in-the-legacy-idmapper-upcall.patch
