Patch "dlm: fix user space lkb refcounting" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    dlm: fix user space lkb refcounting

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     dlm-fix-user-space-lkb-refcounting.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 0a0485c4b278968db53baa875063e498de6fd2a6
Author: Alexander Aring <aahringo@xxxxxxxxxx>
Date:   Tue Mar 12 13:05:07 2024 -0400

    dlm: fix user space lkb refcounting
    
    [ Upstream commit 2ab3d705ca5d4f7ea345a21c3da41a447a549649 ]
    
    This patch fixes to check on the right return value if it was the last
    callback. The rv variable got overwritten by the return of
    copy_result_to_user(). Fixing it by introducing a second variable for
    the return value and don't let rv being overwritten.
    
    Cc: stable@xxxxxxxxxxxxxxx
    Fixes: 61bed0baa4db ("fs: dlm: use a non-static queue for callbacks")
    Reported-by: Valentin Vidić <vvidic@xxxxxxxxxxxxxxxxxxxxxx>
    Closes: https://lore.kernel.org/gfs2/Ze4qSvzGJDt5yxC3@xxxxxxxxxxxxxxxxxxxxxx
    Signed-off-by: Alexander Aring <aahringo@xxxxxxxxxx>
    Signed-off-by: David Teigland <teigland@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/fs/dlm/user.c b/fs/dlm/user.c
index 695e691b38b31..9f9b68448830e 100644
--- a/fs/dlm/user.c
+++ b/fs/dlm/user.c
@@ -806,7 +806,7 @@ static ssize_t device_read(struct file *file, char __user *buf, size_t count,
 	struct dlm_lkb *lkb;
 	DECLARE_WAITQUEUE(wait, current);
 	struct dlm_callback *cb;
-	int rv, copy_lvb = 0;
+	int rv, ret, copy_lvb = 0;
 	int old_mode, new_mode;
 
 	if (count == sizeof(struct dlm_device_version)) {
@@ -906,9 +906,9 @@ static ssize_t device_read(struct file *file, char __user *buf, size_t count,
 		trace_dlm_ast(lkb->lkb_resource->res_ls, lkb);
 	}
 
-	rv = copy_result_to_user(lkb->lkb_ua,
-				 test_bit(DLM_PROC_FLAGS_COMPAT, &proc->flags),
-				 cb->flags, cb->mode, copy_lvb, buf, count);
+	ret = copy_result_to_user(lkb->lkb_ua,
+				  test_bit(DLM_PROC_FLAGS_COMPAT, &proc->flags),
+				  cb->flags, cb->mode, copy_lvb, buf, count);
 
 	kref_put(&cb->ref, dlm_release_callback);
 
@@ -916,7 +916,7 @@ static ssize_t device_read(struct file *file, char __user *buf, size_t count,
 	if (rv == DLM_DEQUEUE_CALLBACK_LAST)
 		dlm_put_lkb(lkb);
 
-	return rv;
+	return ret;
 }
 
 static __poll_t device_poll(struct file *file, poll_table *wait)