Patch "libfs: Re-arrange locking in offset_iterate_dir()" has been added to the 6.8-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    libfs: Re-arrange locking in offset_iterate_dir()

to the 6.8-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     libfs-re-arrange-locking-in-offset_iterate_dir.patch
and it can be found in the queue-6.8 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 673aacfd7b960e934a2b13faf44919196a584271
Author: Chuck Lever <chuck.lever@xxxxxxxxxx>
Date:   Sat Feb 17 15:23:40 2024 -0500

    libfs: Re-arrange locking in offset_iterate_dir()
    
    [ Upstream commit 3f6d810665dfde0d33785420618ceb03fba0619d ]
    
    Liam and Matthew say that once the RCU read lock is released,
    xa_state is not safe to re-use for the next xas_find() call. But the
    RCU read lock must be released on each loop iteration so that
    dput(), which might_sleep(), can be called safely.
    
    Thus we are forced to walk the offset tree with fresh state for each
    directory entry. xa_find() can do this for us, though it might be a
    little less efficient than maintaining xa_state locally.
    
    We believe that in the current code base, inode->i_rwsem provides
    protection for the xa_state maintained in
    offset_iterate_dir(). However, there is no guarantee that will
    continue to be the case in the future.
    
    Since offset_iterate_dir() doesn't build xa_state locally any more,
    there's no longer a strong need for offset_find_next(). Clean up by
    rolling these two helpers together.
    
    Suggested-by: Liam R. Howlett <Liam.Howlett@xxxxxxxxxx>
    Message-ID: <170785993027.11135.8830043889278631735.stgit@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Chuck Lever <chuck.lever@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/170820142021.6328.15047865406275957018.stgit@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    Reviewed-by: Jan Kara <jack@xxxxxxx>
    Signed-off-by: Christian Brauner <brauner@xxxxxxxxxx>
    Stable-dep-of: 23cdd0eed3f1 ("libfs: Fix simple_offset_rename_exchange()")
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/fs/libfs.c b/fs/libfs.c
index eec6031b01554..752e24c669d97 100644
--- a/fs/libfs.c
+++ b/fs/libfs.c
@@ -402,12 +402,13 @@ static loff_t offset_dir_llseek(struct file *file, loff_t offset, int whence)
 	return vfs_setpos(file, offset, U32_MAX);
 }
 
-static struct dentry *offset_find_next(struct xa_state *xas)
+static struct dentry *offset_find_next(struct offset_ctx *octx, loff_t offset)
 {
 	struct dentry *child, *found = NULL;
+	XA_STATE(xas, &octx->xa, offset);
 
 	rcu_read_lock();
-	child = xas_next_entry(xas, U32_MAX);
+	child = xas_next_entry(&xas, U32_MAX);
 	if (!child)
 		goto out;
 	spin_lock(&child->d_lock);
@@ -430,12 +431,11 @@ static bool offset_dir_emit(struct dir_context *ctx, struct dentry *dentry)
 
 static void *offset_iterate_dir(struct inode *inode, struct dir_context *ctx)
 {
-	struct offset_ctx *so_ctx = inode->i_op->get_offset_ctx(inode);
-	XA_STATE(xas, &so_ctx->xa, ctx->pos);
+	struct offset_ctx *octx = inode->i_op->get_offset_ctx(inode);
 	struct dentry *dentry;
 
 	while (true) {
-		dentry = offset_find_next(&xas);
+		dentry = offset_find_next(octx, ctx->pos);
 		if (!dentry)
 			return ERR_PTR(-ENOENT);
 
@@ -444,8 +444,8 @@ static void *offset_iterate_dir(struct inode *inode, struct dir_context *ctx)
 			break;
 		}
 
+		ctx->pos = dentry2offset(dentry) + 1;
 		dput(dentry);
-		ctx->pos = xas.xa_index + 1;
 	}
 	return NULL;
 }