diff --git a/SOURCES/1770-xfs-resample-the-data-fork-mapping-after-cycling-ilock.patch b/SOURCES/1770-xfs-resample-the-data-fork-mapping-after-cycling-ilock.patch new file mode 100644 index 000000000..031cfbd4a --- /dev/null +++ b/SOURCES/1770-xfs-resample-the-data-fork-mapping-after-cycling-ilock.patch @@ -0,0 +1,109 @@ +From e34a2e95ac88e4f13049ddd64f47a361f615bdc3 Mon Sep 17 00:00:00 2001 +From: Carlos Maiolino +Date: Fri, 10 Jul 2026 09:07:22 +0200 +Subject: [PATCH] xfs: resample the data fork mapping after cycling ILOCK + +JIRA: https://redhat.atlassian.net/browse/RHEL-193940 +Upstream Status: git://git.kernel.org/pub/scm/fs/xfs/xfs-linux.git +commit 2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7 +Author: Darrick J. Wong + + xfs: resample the data fork mapping after cycling ILOCK + + xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, + a data fork mapping, and a cow fork mapping. Unfortunately, these two + helpers cycle the ILOCK to grab a transaction, which means that the + mappings are stale as soon as we reacquire the ILOCK. Currently we + refresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but + we don't refresh the data fork mapping beforehand, which means that the + xfs_bmap_trim_cow in that function queries the refcount btree about the + wrong physical blocks and returns an inaccurate value in *shared. + + If *shared is now false, the directio write proceeds with a stale data + fork mapping. Fix this by querying the data fork mapping if the + sequence counter changes across the ILOCK cycle. + + Cc: hch@lst.de + Cc: stable@vger.kernel.org # v4.11 + Fixes: 3c68d44a2b49a0 ("xfs: allocate direct I/O COW blocks in iomap_begin") + Signed-off-by: "Darrick J. Wong" + Reviewed-by: Christoph Hellwig + Reviewed-by: Carlos Maiolino + Signed-off-by: Carlos Maiolino + +Signed-off-by: Carlos Maiolino +--- + fs/xfs/xfs_reflink.c | 36 ++++++++++++++++++++++++++++++++++++ + 1 file changed, 36 insertions(+) + +diff --git a/fs/xfs/xfs_reflink.c b/fs/xfs/xfs_reflink.c +index b11769c009ef..0e4a66ff4e59 100644 +--- a/fs/xfs/xfs_reflink.c ++++ b/fs/xfs/xfs_reflink.c +@@ -389,6 +389,7 @@ xfs_reflink_fill_cow_hole( + struct xfs_mount *mp = ip->i_mount; + struct xfs_trans *tp; + xfs_filblks_t resaligned; ++ unsigned int seq_before = READ_ONCE(ip->i_df.if_seq); + xfs_extlen_t resblks; + int nimaps; + int error; +@@ -408,6 +409,22 @@ xfs_reflink_fill_cow_hole( + + *lockmode = XFS_ILOCK_EXCL; + ++ /* ++ * The data fork mapping may have changed while we dropped the ILOCK ++ * (a racing O_DIRECT writer under IOLOCK_SHARED can complete a full ++ * CoW cycle including xfs_reflink_end_cow(), which remaps this offset ++ * and drops the refcount of the old shared block). Re-read it so the ++ * shared-status recheck below and the caller's in-place iomap both ++ * operate on the current mapping rather than a stale physical block. ++ */ ++ if (seq_before != READ_ONCE(ip->i_df.if_seq)) { ++ nimaps = 1; ++ error = xfs_bmapi_read(ip, imap->br_startoff, ++ imap->br_blockcount, imap, &nimaps, 0); ++ if (error) ++ goto out_trans_cancel; ++ } ++ + error = xfs_find_trim_cow_extent(ip, imap, cmap, shared, &found); + if (error || !*shared) + goto out_trans_cancel; +@@ -454,6 +471,8 @@ xfs_reflink_fill_delalloc( + bool found; + + do { ++ unsigned int seq_before = READ_ONCE(ip->i_df.if_seq); ++ + xfs_iunlock(ip, *lockmode); + *lockmode = 0; + +@@ -464,6 +483,23 @@ xfs_reflink_fill_delalloc( + + *lockmode = XFS_ILOCK_EXCL; + ++ /* ++ * The data fork mapping may have changed while we dropped the ++ * ILOCK (a racing O_DIRECT writer under IOLOCK_SHARED can ++ * complete a full CoW cycle including xfs_reflink_end_cow(), ++ * which remaps this offset and drops the refcount of the old ++ * shared block). Re-read it so the shared-status recheck ++ * below and the caller's in-place iomap both operate on the ++ * current mapping rather than a stale physical block. ++ */ ++ if (seq_before != READ_ONCE(ip->i_df.if_seq)) { ++ nimaps = 1; ++ error = xfs_bmapi_read(ip, imap->br_startoff, ++ imap->br_blockcount, imap, &nimaps, 0); ++ if (error) ++ goto out_trans_cancel; ++ } ++ + error = xfs_find_trim_cow_extent(ip, imap, cmap, shared, + &found); + if (error || !*shared) +-- +GitLab + diff --git a/SPECS/kernel.spec b/SPECS/kernel.spec index fde5a933a..a99af7d97 100644 --- a/SPECS/kernel.spec +++ b/SPECS/kernel.spec @@ -176,13 +176,13 @@ Summary: The Linux kernel # define buildid .local %define specversion 5.14.0 %define patchversion 5.14 -%define pkgrelease 687.25.1 +%define pkgrelease 687.26.1 %define kversion 5 %define tarfile_release 5.14.0-687.5.1.el9_8 # This is needed to do merge window version magic %define patchlevel 14 # This allows pkg_release to have configurable %%{?dist} tag -%define specrelease 687.25.1%{?buildid}%{?dist} +%define specrelease 687.26.1%{?buildid}%{?dist} # This defines the kabi tarball version %define kabiversion 5.14.0-687.5.1.el9_8 @@ -1638,6 +1638,7 @@ Patch1766: 1766-rtmutex-use-waiter-task-instead-of-current-in-remove-waiter.patc Patch1767: 1767-futex-requeue-prevent-null-pointer-dereference-in-remove-waiter.patch Patch1768: 1768-locking-rtmutex-skip-remove-waiter-when-waiter-is-not-enqueued.patch Patch1769: 1769-futex-requeue-revert-prevent-null-pointer-dereference.patch +Patch1770: 1770-xfs-resample-the-data-fork-mapping-after-cycling-ilock.patch # END OF PATCH DEFINITIONS %description @@ -3043,6 +3044,7 @@ ApplyPatch 1766-rtmutex-use-waiter-task-instead-of-current-in-remove-waiter.patc ApplyPatch 1767-futex-requeue-prevent-null-pointer-dereference-in-remove-waiter.patch ApplyPatch 1768-locking-rtmutex-skip-remove-waiter-when-waiter-is-not-enqueued.patch ApplyPatch 1769-futex-requeue-revert-prevent-null-pointer-dereference.patch +ApplyPatch 1770-xfs-resample-the-data-fork-mapping-after-cycling-ilock.patch # END OF PATCH APPLICATIONS # Any further pre-build tree manipulations happen here. @@ -5117,6 +5119,13 @@ fi # # %changelog +* Tue Jul 14 2026 Andrew Lukoshko - 5.14.0-687.26.1 +- Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) +- RHEL changelog for 687.26.1 follows: + +* Mon Jul 13 2026 CKI KWF Bot [5.14.0-687.26.1.el9_8] +- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] + * Mon Jul 13 2026 Andrew Lukoshko - 5.14.0-687.25.1 - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499