Patch "fs/pipe: do not open-code pipe head/tail logic in FIONREAD" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    fs/pipe: do not open-code pipe head/tail logic in FIONREAD

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     fs-pipe-do-not-open-code-pipe-head-tail-logic-in-fio.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 1ee8e42441a3a9ae2524d1d90d97a41660f68929
Author: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>
Date:   Thu Mar 6 07:33:58 2025 -1000

    fs/pipe: do not open-code pipe head/tail logic in FIONREAD
    
    [ Upstream commit d810d4c27bf34c719243bab9feb0d843edc09fd7 ]
    
    Rasmus points out that we do indeed have other cases of breakage from
    the type changes that were introduced on 32-bit targets in order to read
    the pipe head and tail values atomically (commit 3d252160b818: "fs/pipe:
    Read pipe->{head,tail} atomically outside pipe->mutex").
    
    Fix it up by using the proper helper functions that now deal with the
    pipe buffer index types properly.  This makes the code simpler and more
    obvious.
    
    The compiler does the CSE and loop hoisting of the pipe ring size
    masking that we used to do manually, so open-coding this was never a
    good idea.
    
    Reported-by: Rasmus Villemoes <ravi@xxxxxxxxx>
    Link: https://lore.kernel.org/all/87cyeu5zgk.fsf@xxxxxxxxx/
    Fixes: 3d252160b818 ("fs/pipe: Read pipe->{head,tail} atomically outside pipe->mutex")Cc: Oleg Nesterov <oleg@xxxxxxxxxx>
    Cc: Mateusz Guzik <mjguzik@xxxxxxxxx>
    Cc: K Prateek Nayak <kprateek.nayak@xxxxxxx>
    Cc: Swapnil Sapkal <swapnil.sapkal@xxxxxxx>
    Signed-off-by: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/fs/pipe.c b/fs/pipe.c
index d8f7c56d438d7..ac08addbaa638 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -611,7 +611,7 @@ pipe_write(struct kiocb *iocb, struct iov_iter *from)
 static long pipe_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 {
 	struct pipe_inode_info *pipe = filp->private_data;
-	unsigned int count, head, tail, mask;
+	unsigned int count, head, tail;
 
 	switch (cmd) {
 	case FIONREAD:
@@ -619,10 +619,9 @@ static long pipe_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 		count = 0;
 		head = pipe->head;
 		tail = pipe->tail;
-		mask = pipe->ring_size - 1;
 
-		while (tail != head) {
-			count += pipe->bufs[tail & mask].len;
+		while (!pipe_empty(head, tail)) {
+			count += pipe_buf(pipe, tail)->len;
 			tail++;
 		}
 		__pipe_unlock(pipe);