Recreate RHEL 5.14.0-687.26.1 from CS9 backports
Add the xfs data-fork resample fix (1770), sourced from the CS9 merge request (gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9 MR 8364).
This commit is contained in:
parent
4ce490ce48
commit
c8142635f0
@ -0,0 +1,109 @@
|
||||
From e34a2e95ac88e4f13049ddd64f47a361f615bdc3 Mon Sep 17 00:00:00 2001
|
||||
From: Carlos Maiolino <cmaiolino@redhat.com>
|
||||
Date: Fri, 10 Jul 2026 09:07:22 +0200
|
||||
Subject: [PATCH] xfs: resample the data fork mapping after cycling ILOCK
|
||||
|
||||
JIRA: https://redhat.atlassian.net/browse/RHEL-193940
|
||||
Upstream Status: git://git.kernel.org/pub/scm/fs/xfs/xfs-linux.git
|
||||
commit 2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7
|
||||
Author: Darrick J. Wong <djwong@kernel.org>
|
||||
|
||||
xfs: resample the data fork mapping after cycling ILOCK
|
||||
|
||||
xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode,
|
||||
a data fork mapping, and a cow fork mapping. Unfortunately, these two
|
||||
helpers cycle the ILOCK to grab a transaction, which means that the
|
||||
mappings are stale as soon as we reacquire the ILOCK. Currently we
|
||||
refresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but
|
||||
we don't refresh the data fork mapping beforehand, which means that the
|
||||
xfs_bmap_trim_cow in that function queries the refcount btree about the
|
||||
wrong physical blocks and returns an inaccurate value in *shared.
|
||||
|
||||
If *shared is now false, the directio write proceeds with a stale data
|
||||
fork mapping. Fix this by querying the data fork mapping if the
|
||||
sequence counter changes across the ILOCK cycle.
|
||||
|
||||
Cc: hch@lst.de
|
||||
Cc: stable@vger.kernel.org # v4.11
|
||||
Fixes: 3c68d44a2b49a0 ("xfs: allocate direct I/O COW blocks in iomap_begin")
|
||||
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
|
||||
Reviewed-by: Christoph Hellwig <hch@lst.de>
|
||||
Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com>
|
||||
Signed-off-by: Carlos Maiolino <cem@kernel.org>
|
||||
|
||||
Signed-off-by: Carlos Maiolino <cmaiolino@redhat.com>
|
||||
---
|
||||
fs/xfs/xfs_reflink.c | 36 ++++++++++++++++++++++++++++++++++++
|
||||
1 file changed, 36 insertions(+)
|
||||
|
||||
diff --git a/fs/xfs/xfs_reflink.c b/fs/xfs/xfs_reflink.c
|
||||
index b11769c009ef..0e4a66ff4e59 100644
|
||||
--- a/fs/xfs/xfs_reflink.c
|
||||
+++ b/fs/xfs/xfs_reflink.c
|
||||
@@ -389,6 +389,7 @@ xfs_reflink_fill_cow_hole(
|
||||
struct xfs_mount *mp = ip->i_mount;
|
||||
struct xfs_trans *tp;
|
||||
xfs_filblks_t resaligned;
|
||||
+ unsigned int seq_before = READ_ONCE(ip->i_df.if_seq);
|
||||
xfs_extlen_t resblks;
|
||||
int nimaps;
|
||||
int error;
|
||||
@@ -408,6 +409,22 @@ xfs_reflink_fill_cow_hole(
|
||||
|
||||
*lockmode = XFS_ILOCK_EXCL;
|
||||
|
||||
+ /*
|
||||
+ * The data fork mapping may have changed while we dropped the ILOCK
|
||||
+ * (a racing O_DIRECT writer under IOLOCK_SHARED can complete a full
|
||||
+ * CoW cycle including xfs_reflink_end_cow(), which remaps this offset
|
||||
+ * and drops the refcount of the old shared block). Re-read it so the
|
||||
+ * shared-status recheck below and the caller's in-place iomap both
|
||||
+ * operate on the current mapping rather than a stale physical block.
|
||||
+ */
|
||||
+ if (seq_before != READ_ONCE(ip->i_df.if_seq)) {
|
||||
+ nimaps = 1;
|
||||
+ error = xfs_bmapi_read(ip, imap->br_startoff,
|
||||
+ imap->br_blockcount, imap, &nimaps, 0);
|
||||
+ if (error)
|
||||
+ goto out_trans_cancel;
|
||||
+ }
|
||||
+
|
||||
error = xfs_find_trim_cow_extent(ip, imap, cmap, shared, &found);
|
||||
if (error || !*shared)
|
||||
goto out_trans_cancel;
|
||||
@@ -454,6 +471,8 @@ xfs_reflink_fill_delalloc(
|
||||
bool found;
|
||||
|
||||
do {
|
||||
+ unsigned int seq_before = READ_ONCE(ip->i_df.if_seq);
|
||||
+
|
||||
xfs_iunlock(ip, *lockmode);
|
||||
*lockmode = 0;
|
||||
|
||||
@@ -464,6 +483,23 @@ xfs_reflink_fill_delalloc(
|
||||
|
||||
*lockmode = XFS_ILOCK_EXCL;
|
||||
|
||||
+ /*
|
||||
+ * The data fork mapping may have changed while we dropped the
|
||||
+ * ILOCK (a racing O_DIRECT writer under IOLOCK_SHARED can
|
||||
+ * complete a full CoW cycle including xfs_reflink_end_cow(),
|
||||
+ * which remaps this offset and drops the refcount of the old
|
||||
+ * shared block). Re-read it so the shared-status recheck
|
||||
+ * below and the caller's in-place iomap both operate on the
|
||||
+ * current mapping rather than a stale physical block.
|
||||
+ */
|
||||
+ if (seq_before != READ_ONCE(ip->i_df.if_seq)) {
|
||||
+ nimaps = 1;
|
||||
+ error = xfs_bmapi_read(ip, imap->br_startoff,
|
||||
+ imap->br_blockcount, imap, &nimaps, 0);
|
||||
+ if (error)
|
||||
+ goto out_trans_cancel;
|
||||
+ }
|
||||
+
|
||||
error = xfs_find_trim_cow_extent(ip, imap, cmap, shared,
|
||||
&found);
|
||||
if (error || !*shared)
|
||||
--
|
||||
GitLab
|
||||
|
||||
@ -176,13 +176,13 @@ Summary: The Linux kernel
|
||||
# define buildid .local
|
||||
%define specversion 5.14.0
|
||||
%define patchversion 5.14
|
||||
%define pkgrelease 687.25.1
|
||||
%define pkgrelease 687.26.1
|
||||
%define kversion 5
|
||||
%define tarfile_release 5.14.0-687.5.1.el9_8
|
||||
# This is needed to do merge window version magic
|
||||
%define patchlevel 14
|
||||
# This allows pkg_release to have configurable %%{?dist} tag
|
||||
%define specrelease 687.25.1%{?buildid}%{?dist}
|
||||
%define specrelease 687.26.1%{?buildid}%{?dist}
|
||||
# This defines the kabi tarball version
|
||||
%define kabiversion 5.14.0-687.5.1.el9_8
|
||||
|
||||
@ -1638,6 +1638,7 @@ Patch1766: 1766-rtmutex-use-waiter-task-instead-of-current-in-remove-waiter.patc
|
||||
Patch1767: 1767-futex-requeue-prevent-null-pointer-dereference-in-remove-waiter.patch
|
||||
Patch1768: 1768-locking-rtmutex-skip-remove-waiter-when-waiter-is-not-enqueued.patch
|
||||
Patch1769: 1769-futex-requeue-revert-prevent-null-pointer-dereference.patch
|
||||
Patch1770: 1770-xfs-resample-the-data-fork-mapping-after-cycling-ilock.patch
|
||||
# END OF PATCH DEFINITIONS
|
||||
|
||||
%description
|
||||
@ -3043,6 +3044,7 @@ ApplyPatch 1766-rtmutex-use-waiter-task-instead-of-current-in-remove-waiter.patc
|
||||
ApplyPatch 1767-futex-requeue-prevent-null-pointer-dereference-in-remove-waiter.patch
|
||||
ApplyPatch 1768-locking-rtmutex-skip-remove-waiter-when-waiter-is-not-enqueued.patch
|
||||
ApplyPatch 1769-futex-requeue-revert-prevent-null-pointer-dereference.patch
|
||||
ApplyPatch 1770-xfs-resample-the-data-fork-mapping-after-cycling-ilock.patch
|
||||
# END OF PATCH APPLICATIONS
|
||||
|
||||
# Any further pre-build tree manipulations happen here.
|
||||
@ -5117,6 +5119,13 @@ fi
|
||||
#
|
||||
#
|
||||
%changelog
|
||||
* Tue Jul 14 2026 Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.26.1
|
||||
- Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770)
|
||||
- RHEL changelog for 687.26.1 follows:
|
||||
|
||||
* Mon Jul 13 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.26.1.el9_8]
|
||||
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]
|
||||
|
||||
* Mon Jul 13 2026 Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.25.1
|
||||
- Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769)
|
||||
- The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499
|
||||
|
||||
Loading…
Reference in New Issue
Block a user