linux.git/fs, branch v5.13.4

seq_file: disallow extremely large seq buffer allocations

2021-07-20T14:00:42+00:00

commit 8cae8cd89f05f6de223d63e6d15e31c8ba9cf53b upstream.

There is no reasonable need for a buffer larger than this, and it avoids
int overflow pitfalls.

Fixes: 058504edd026 ("fs/seq_file: fallback to vmalloc allocation")
Suggested-by: Al Viro 
Reported-by: Qualys Security Advisory 
Signed-off-by: Eric Sandeen 
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

NFSv4/pNFS: Don't call _nfs4_pnfs_v3_ds_connect multiple times

2021-07-20T14:00:34+00:00

[ Upstream commit f46f84931a0aa344678efe412d4b071d84d8a805 ]

After we grab the lock in nfs4_pnfs_ds_connect(), there is no check for
whether or not ds->ds_clp has already been initialised, so we can end up
adding the same transports multiple times.

Fixes: fc821d59209d ("pnfs/NFSv4.1: Add multipath capabilities to pNFS flexfiles servers over NFSv3")
Signed-off-by: Trond Myklebust 
Signed-off-by: Sasha Levin

NFSv4/pnfs: Fix layoutget behaviour after invalidation

2021-07-20T14:00:34+00:00

[ Upstream commit 0b77f97a7e42adc72bd566ff8cb733ea426f74f6 ]

If the layout gets invalidated, we should wait for any outstanding
layoutget requests for that layout to complete, and we should resend
them only after re-establishing the layout stateid.

Fixes: d29b468da4f9 ("pNFS/NFSv4: Improve rejection of out-of-order layouts")
Signed-off-by: Trond Myklebust 
Signed-off-by: Sasha Levin

NFSv4/pnfs: Fix the layout barrier update

2021-07-20T14:00:34+00:00

[ Upstream commit aa95edf309ef31e2df4a37ebf0e5c2ca2a6772ab ]

If we have multiple outstanding layoutget requests, the current code to
update the layout barrier assumes that the outstanding layout stateids
are updated in order. That's not necessarily the case.

Instead of using the value of lo->plh_outstanding as a guesstimate for
the window of values we need to accept, just wait to update the window
until we're processing the last one. The intention here is just to
ensure that we don't process 2^31 seqid updates without also updating
the barrier.

Fixes: 1bcf34fdac5f ("pNFS/NFSv4: Update the layout barrier when we schedule a layoutreturn")
Signed-off-by: Trond Myklebust 
Signed-off-by: Sasha Levin

NFS: Fix fscache read from NFS after cache error

2021-07-20T14:00:34+00:00

[ Upstream commit ba512c1bc3232124567a59a3995c773dc79716e8 ]

Earlier commits refactored some NFS read code and removed
nfs_readpage_async(), but neglected to properly fixup
nfs_readpage_from_fscache_complete().  The code path is
only hit when something unusual occurs with the cachefiles
backing filesystem, such as an IO error or while a cookie
is being invalidated.

Mark page with PG_checked if fscache IO completes in error,
unlock the page, and let the VM decide to re-issue based on
PG_uptodate.  When the VM reissues the readpage, PG_checked
allows us to skip over fscache and read from the server.

Link: https://marc.info/?l=linux-nfs&m=162498209518739
Fixes: 1e83b173b266 ("NFS: Add nfs_pageio_complete_read() and remove nfs_readpage_async()")
Signed-off-by: Dave Wysochanski 
Signed-off-by: Trond Myklebust 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

NFS: Ensure nfs_readpage returns promptly when internal error occurs

2021-07-20T14:00:34+00:00

commit e0340f16a08d031de54ed91d26f57c9a966a776a upstream.

A previous refactoring of nfs_readpage() might end up calling
wait_on_page_locked_killable() even if readpage_async_filler() failed
with an internal error and pg_error was non-zero (for example, if
nfs_create_request() failed).  In the case of an internal error,
skip over wait_on_page_locked_killable() as this is only needed
when the read is sent and an error occurs during completion handling.

Signed-off-by: Dave Wysochanski 
Signed-off-by: Trond Myklebust 
Signed-off-by: Greg Kroah-Hartman

nfsd: fix NULL dereference in nfs3svc_encode_getaclres

2021-07-20T14:00:33+00:00

[ Upstream commit ab1016d39cc052064e32f25ad18ef8767a0ee3b8 ]

In error cases the dentry may be NULL.

Before 20798dfe249a, the encoder also checked dentry and
d_really_is_positive(dentry), but that looks like overkill to me--zero
status should be enough to guarantee a positive dentry.

This isn't the first time we've seen an error-case NULL dereference
hidden in the initialization of a local variable in an xdr encoder.  But
I went back through the other recent rewrites and didn't spot any
similar bugs.

Reported-by: JianHong Yin 
Reviewed-by: Chuck Lever III 
Fixes: 20798dfe249a ("NFSD: Update the NFSv3 GETACL result encoder...")
Signed-off-by: J. Bruce Fields 
Signed-off-by: Sasha Levin

NFSD: Prevent a possible oops in the nfs_dirent() tracepoint

2021-07-20T14:00:33+00:00

[ Upstream commit 7b08cf62b1239a4322427d677ea9363f0ab677c6 ]

The double copy of the string is a mistake, plus __assign_str()
uses strlen(), which is wrong to do on a string that isn't
guaranteed to be NUL-terminated.

Fixes: 6019ce0742ca ("NFSD: Add a tracepoint to record directory entry encoding")
Signed-off-by: Chuck Lever 
Signed-off-by: J. Bruce Fields 
Signed-off-by: Sasha Levin

nfsd: Reduce contention for the nfsd_file nf_rwsem

2021-07-20T14:00:33+00:00

[ Upstream commit 474bc334698df98ce07c890f1898c7e7f389b0c7 ]

When flushing out the unstable file writes as part of a COMMIT call, try
to perform most of of the data writes and waits outside the semaphore.

This means that if the client is sending the COMMIT as part of a memory
reclaim operation, then it can continue performing I/O, with contention
for the lock occurring only once the data sync is finished.

Fixes: 5011af4c698a ("nfsd: Fix stable writes")
Signed-off-by: Trond Myklebust 
 Tested-by: Chuck Lever 
Signed-off-by: J. Bruce Fields 
Signed-off-by: Sasha Levin

nfsd: move fsnotify on client creation outside spinlock

2021-07-20T14:00:33+00:00

[ Upstream commit 934bd07fae7e55232845f909f78873ab8678ca74 ]

This was causing a "sleeping function called from invalid context"
warning.

I don't think we need the set_and_test_bit() here; clients move from
unconfirmed to confirmed only once, under the client_lock.

The (conf == unconf) is a way to check whether we're in that confirming
case, hopefully that's not too obscure.

Fixes: 472d155a0631 "nfsd: report client confirmation status in "info" file"
Signed-off-by: J. Bruce Fields 
Signed-off-by: Sasha Levin