Patch "netfs: Fix kernel async DIO" has been added to the 6.12-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    netfs: Fix kernel async DIO

to the 6.12-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     netfs-fix-kernel-async-dio.patch
and it can be found in the queue-6.12 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 71af0ad00e6bed5a957110d914f906a3498ebca1
Author: David Howells <dhowells@xxxxxxxxxx>
Date:   Tue Jan 7 18:39:27 2025 +0000

    netfs: Fix kernel async DIO
    
    [ Upstream commit 3f6bc9e3ab9b127171d39f9ac6eca1abb693b731 ]
    
    Netfslib needs to be able to handle kernel-initiated asynchronous DIO that
    is supplied with a bio_vec[] array.  Currently, because of the async flag,
    this gets passed to netfs_extract_user_iter() which throws a warning and
    fails because it only handles IOVEC and UBUF iterators.  This can be
    triggered through a combination of cifs and a loopback blockdev with
    something like:
    
            mount //my/cifs/share /foo
            dd if=/dev/zero of=/foo/m0 bs=4K count=1K
            losetup --sector-size 4096 --direct-io=on /dev/loop2046 /foo/m0
            echo hello >/dev/loop2046
    
    This causes the following to appear in syslog:
    
            WARNING: CPU: 2 PID: 109 at fs/netfs/iterator.c:50 netfs_extract_user_iter+0x170/0x250 [netfs]
    
    and the write to fail.
    
    Fix this by removing the check in netfs_unbuffered_write_iter_locked() that
    causes async kernel DIO writes to be handled as userspace writes.  Note
    that this change relies on the kernel caller maintaining the existence of
    the bio_vec array (or kvec[] or folio_queue) until the op is complete.
    
    Fixes: 153a9961b551 ("netfs: Implement unbuffered/DIO write support")
    Reported-by: Nicolas Baranger <nicolas.baranger@xxxxxx>
    Closes: https://lore.kernel.org/r/fedd8a40d54b2969097ffa4507979858@xxxxxx/
    Signed-off-by: David Howells <dhowells@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/608725.1736275167@xxxxxxxxxxxxxxxxxxxxxx
    Tested-by: Nicolas Baranger <nicolas.baranger@xxxxxx>
    Acked-by: Paulo Alcantara (Red Hat) <pc@xxxxxxxxxxxxx>
    cc: Steve French <smfrench@xxxxxxxxx>
    cc: Jeff Layton <jlayton@xxxxxxxxxx>
    cc: netfs@xxxxxxxxxxxxxxx
    cc: linux-cifs@xxxxxxxxxxxxxxx
    cc: linux-fsdevel@xxxxxxxxxxxxxxx
    Signed-off-by: Christian Brauner <brauner@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/fs/netfs/direct_write.c b/fs/netfs/direct_write.c
index 88f2adfab75e..26cf9c94deeb 100644
--- a/fs/netfs/direct_write.c
+++ b/fs/netfs/direct_write.c
@@ -67,7 +67,7 @@ ssize_t netfs_unbuffered_write_iter_locked(struct kiocb *iocb, struct iov_iter *
 		 * allocate a sufficiently large bvec array and may shorten the
 		 * request.
 		 */
-		if (async || user_backed_iter(iter)) {
+		if (user_backed_iter(iter)) {
 			n = netfs_extract_user_iter(iter, len, &wreq->iter, 0);
 			if (n < 0) {
 				ret = n;
@@ -77,6 +77,11 @@ ssize_t netfs_unbuffered_write_iter_locked(struct kiocb *iocb, struct iov_iter *
 			wreq->direct_bv_count = n;
 			wreq->direct_bv_unpin = iov_iter_extract_will_pin(iter);
 		} else {
+			/* If this is a kernel-generated async DIO request,
+			 * assume that any resources the iterator points to
+			 * (eg. a bio_vec array) will persist till the end of
+			 * the op.
+			 */
 			wreq->iter = *iter;
 		}