Patch "afs: Fix the server_list to unuse a displaced server rather than putting it" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    afs: Fix the server_list to unuse a displaced server rather than putting it

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     afs-fix-the-server_list-to-unuse-a-displaced-server-.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 42818f1709e47e92a07145178c35a7b9e81e5e1e
Author: David Howells <dhowells@xxxxxxxxxx>
Date:   Tue Feb 18 19:22:47 2025 +0000

    afs: Fix the server_list to unuse a displaced server rather than putting it
    
    [ Upstream commit add117e48df4788a86a21bd0515833c0a6db1ad1 ]
    
    When allocating and building an afs_server_list struct object from a VLDB
    record, we look up each server address to get the server record for it -
    but a server may have more than one entry in the record and we discard the
    duplicate pointers.  Currently, however, when we discard, we only put a
    server record, not unuse it - but the lookup got as an active-user count.
    
    The active-user count on an afs_server_list object determines its lifetime
    whereas the refcount keeps the memory backing it around.  Failing to reduce
    the active-user counter prevents the record from being cleaned up and can
    lead to multiple copied being seen - and pointing to deleted afs_cell
    objects and other such things.
    
    Fix this by switching the incorrect 'put' to an 'unuse' instead.
    
    Without this, occasionally, a dead server record can be seen in
    /proc/net/afs/servers and list corruption may be observed:
    
        list_del corruption. prev->next should be ffff888102423e40, but was 0000000000000000. (prev=ffff88810140cd38)
    
    Fixes: 977e5f8ed0ab ("afs: Split the usage count on struct afs_server")
    Signed-off-by: David Howells <dhowells@xxxxxxxxxx>
    cc: Marc Dionne <marc.dionne@xxxxxxxxxxxx>
    cc: Simon Horman <horms@xxxxxxxxxx>
    cc: linux-afs@xxxxxxxxxxxxxxxxxxx
    Link: https://patch.msgid.link/20250218192250.296870-5-dhowells@xxxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/fs/afs/server_list.c b/fs/afs/server_list.c
index 4d6369477f54e..89c75d934f79e 100644
--- a/fs/afs/server_list.c
+++ b/fs/afs/server_list.c
@@ -67,8 +67,8 @@ struct afs_server_list *afs_alloc_server_list(struct afs_volume *volume,
 				break;
 		if (j < slist->nr_servers) {
 			if (slist->servers[j].server == server) {
-				afs_put_server(volume->cell->net, server,
-					       afs_server_trace_put_slist_isort);
+				afs_unuse_server(volume->cell->net, server,
+						 afs_server_trace_put_slist_isort);
 				continue;
 			}