- Kernel - mailweb.openeuler.org

[PATCH v2 OLK-6.6] xsched: Add XSched manual
by Liu Kai 14 Jan '26

14 Jan '26

hulk inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8232 -------------------------------- Add user manual for XSched. Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- Documentation/scheduler/xsched.md | 355 ++++++++++++++++++++++++++++++ 1 file changed, 355 insertions(+) create mode 100644 Documentation/scheduler/xsched.md diff --git a/Documentation/scheduler/xsched.md b/Documentation/scheduler/xsched.md new file mode 100644 index 000000000000..89ef01d42fc0 --- /dev/null +++ b/Documentation/scheduler/xsched.md @@ -0,0 +1,355 @@ +# XSched 用户指南 + +## 1 环境部署 + +### 1.1 安装 NPU 原生软件栈 + +本特性依赖 NPU 原生软件栈，需要安装 NPU driver、firmware、CANN + +### 1.2 安装XSched内核 + +#### 1.2.1 获取内核源码 + +```bash +# 下载源码 +git clone https://atomgit.com/openeuler/kernel.git -b OLK-6.6 OLK-6.6 + +# 进入内核目录 +cd OLK-6.6 +``` + +#### 1.2.2 安装内核 + +##### 1.2.2.1 修改内核配置 + +```shell +# 生成默认配置 +make openeuler_defconfig + +# 修改并保存配置 +vim .config + +CONFIG_XCU_SCHEDULER=y +CONFIG_XCU_VSTREAM=y +CONFIG_XSCHED_NR_CUS=8 # 根据 NPU 卡的数量配置 +CONFIG_XCU_SCHED_RT=y +CONFIG_XCU_SCHED_CFS=y +CONFIG_CGROUP_XCU=y +``` + +##### 1.2.2.2 编译安装 + +以下方式**二选一**： + +* 源码编译安装 + + ```bash + make clean && make -j$(nproc) + make modules_install -j$(nproc) INSTALL_MOD_STRIP=1 && INSTALL_MOD_STRIP=1 make install + grub2-set-default 0 + ``` + +* RPM 包编译安装 + + ```bash + INSTALL_MOD_STRIP=1 make rpm-pkg -j `nproc` + # kernel 和 devel 包都要安装，否则会导致驱动无法重编 + rpm -ivh <path_to_rpm> --force + grub2-set-default 0 + ``` + +##### 1.2.2.3 修改 cmdline + +```shell +# 修改内核引导文件，根据实际情况编辑 +vim /etc/grub2-efi.cfg + +# 在XSched内核新增 cmdline 配置，关闭驱动签名校验、开启cgroup-v2 +module.sig_enforce=0 systemd.unified_cgroup_hierarchy=1 cgroup_no_v1=all +``` + +保存引导文件后，重启切换内核 + +### 1.3 重编驱动 + +**！！需先安装好原生驱动！！**，`npu-smi info` 检查驱动是否安装成功 + +#### 1.3.1 修改驱动 + +获取驱动源码 + +```shell +mkdir <new_driver_dir> + +./Ascend-hdk-910b-npu-driver_xx.x.x_linux-aarch64.run --tar -xvf -C <new_driver_dir> +``` + +下载驱动补丁 [XSched driver patch](https://gitee.com/openeuler/kernel/commit/8d50448f11b697a177b63d3ccb… 适配 NPU 驱动 + +```shell +cp 0001-Adapt-910b-npu-driver-for-xsched.patch <new_driver_dir>/driver/kernel/ +cd <new_driver_dir>/driver/kernel/ + +# 初始化 git 仓库并应用补丁 +git init +git add . +git commit -m "npu init" +# 如果有冲突则根据 .rej 文件适配冲突代码 +git am 0001-Adapt-910b-npu-driver-for-xsched.patch --reject +``` + +#### 1.3.2 替换驱动 + +```shell +# 返回驱动根目录 +cd ../../ + +# 备份原生驱动 ko +cp -r <new_driver_dir>/driver/host <new_driver_dir>/driver/host-bak +rm -f <new_driver_dir>/driver/host/* + +cd <new_driver_dir>/driver/script +# 如果强制重编则增加 --force 参数，驱动 ko 会生成到 <new_driver_dir>/driver/host/ +sh run_driver_ko_rebuild.sh [--force] + +# 替换驱动 +for line in `ls /lib/modules/$(uname -r)/updates`; do \cp ../host/$line /lib/modules/$(uname -r)/updates; done +``` + +#### 1.3.3 检查驱动 + +重启后检查驱动是否替换成功 + +```shell +reboot +npu-smi info +``` + +### 1.4 libXSched + +XSched 用户态拦截层，拦截 CANN API 并转发到 XSched 内核 + +#### 1.4.1 编译 + +获取源码 + +```bash +git clone https://atomgit.com/openeuler/libXSched.git +``` + +编译源码 + +```bash +# 准备头文件 +cp OLK-6.6/include/uapi/linux/xsched/xcu_vstream.h /usr/include/linux + +# 编译生成 libucc_engine.so +make clean && make +``` + +#### 1.4.2 使用 + +使用 `LD_PRELOAD` 加载 `libucc_engine.so` + +```bash +LD_PRELOAD=<path_to_libucc> <run_model_script> +``` + +### 1.5 验证 + +```shell +# 开启 XSched 日志 +echo "file kernel/xsched/* +p" > /sys/kernel/debug/dynamic_debug/control + +# pytorch 框架 +LD_PRELOAD=<path_to_libucc> python3 -c "import torch;import torch_npu; a = torch.randn(3, 4).npu(); print(a + a);" + +# mindspore 框架 +LD_PRELOAD=<path_to_libucc> python3 -c "import mindspore;mindspore.set_device('Ascend');mindspore.run_check()" +``` + +`dmesg` 查看内核日志，检查是否有 XSCHED 日志，有日志则说明 XSched 环境部署成功，验证完后关闭 XSched 日志 `echo "file kernel/xsched/* -p" > /sys/kernel/debug/dynamic_debug/control` + +## 2 使用指南 + +### 2.1 Cgroup 接口 + +#### 2.1.1 配置 XSched 策略 + +使能 XSched 控制器 + +```bash +echo "+xcu" > /sys/fs/cgroup/cgroup.subtree_control +``` + +##### 2.1.1.1 可配置接口 + +* `xcu.sched_class`：配置调度类，cfs 或 rt + +* `xcu.period_ms`：配置获取算力资源时间片周期，默认 100ms（需先设置为 cfs 调度类） + +* `xcu.quota_ms`：配置周期内可分配的时间片，比如配置 50ms，则每 100ms 内可分配 50ms，-1 则是不管控算力资源（需先设置为 cfs 调度类） + +* `xcu.shares`：配置 cfs 任务的权重，权重越大，相比于其他任务的优先级越高，默认为 1024（需先设置为 cfs 调度类） + +* `xcu.stat`：查看统计信息，仅支持 cfs 调度类 + +##### 2.1.1.2 Host 使用方法 + +在主机侧使用 XSched 管控 ai 任务，需手动创建 cgroup 组 + +```bash +mkdir -p /sys/fs/cgroup/xsched_group + +# 按需配置 XSched 策略，例如 echo cfs > /sys/fs/cgroup/xsched_group/xcu.sched_class +echo <config_value> > /sys/fs/cgroup/xsched_group/xcu.<config_item> +``` + +将 ai 任务加入到 cgroup 中管控算力资源 + +```bash +# 运行 ai 任务 +LD_PRELOAD=<path_to_libucc> <run_model_script> + +# 加入 ai 任务到 cgroup +echo <pid> > /sys/fs/cgroup/xsched_group/cgroup.procs +``` + +##### 2.1.1.3 Docker 使用方法 + +启动 docker 容器时会自动挂载到 cgroup 目录（`/sys/fs/cgroup/user.slice`）下，docker 内的任务的 pid 也会自动添加到 cgroup.procs 下，无需手动创建 cgroup 组和添加任务 + +1. 修改 docker 配置，修改挂载的 cgroup 目录和 docker 的 cgroup 版本为 v2（**docker 需升级到支持 cgroup-v2 的版本**） + + ```bash + vim /etc/docker/daemon.json + + # 添加以下配置 + # 挂载的 cgroup 目录，目录名任意，以 docker.slice 为例 + "cgroup-parent": "docker.slice" + # 使用 cgroup-v2 管理 docker + "exec-opts": ["native.cgroupdriver=systemd"] + + # 修改保存后重启 docker 服务 + systemctl restart docker + ``` + + 因为 docker 默认的挂载目录是 `/sys/fs/cgroup/user.slice` ，`user.slice` 下还会有其他的用户任务在运行，可能会无法修改 `user.slice` 的 XSched 配置，所以需要修改 docker 的挂载目录为 `/sys/fs/cgroup/docker.slice` 方便配置和管理 + +2. 配置 docker 的 xsched 调度策略 + + ```bash + # 修改调度类为 cfs + echo cfs > /sys/fs/cgroup/docker.slice/xcu.sched_class + + # 启动容器 + docker start <container_name> + + # 配置对应容器的 xsched 策略 + echo <config_value> > /sys/fs/cgroup/docker.slice/docker-<docker_id>/xcu.<config_item> + + # 进入容器 + docker exec -it <container_name> bash + + # 运行 ai 任务（容器内也有 libucc_engine.so），pid 会自动添加到 /sys/fs/cgroup/docker.slice/docker-<docker_id>/cgroup.procs + LD_PRELOAD=<path_to_libucc> <run_model_script> + ``` + +### 2.2 Syscall 接口 + +提供两个 syscall 接口用于设置/获取 rt 调度类的任务优先级（`xsched_setattr/xsched_getattr`） + +* `pid`：ai 任务 pid，pid=0 表示当前进程 + +* `struct xsched_attr`：XSched 可配置属性 + + ```c + struct xsched_attr { + __u32 xsched_class; // 调度类，当前仅支持 RT（xsched_class=0） + __u32 xsched_priority; // rt 优先级，可配置范围 [1,5]，数字越大，优先级越高 + }; + ``` + +调用 syscall 接口示例程序： + +```c +#include <stdio.h> +#include <stdlib.h> +#include <unistd.h> +#include <string.h> +#include <errno.h> +#include <sys/syscall.h> +#include <stdint.h> +#include <sys/types.h> + +// Define xsched_attr structure +struct xsched_attr { + uint32_t xsched_class; // Scheduling class: XSCHED_TYPE_RT, XSCHED_TYPE_CFS + uint32_t xsched_priority; // Priority level: 1~5 +}; + +// Scheduling class constants (should match kernel header definitions) +#define XSCHED_TYPE_RT 0 // Real-time scheduling class +#define XSCHED_TYPE_CFS 1 // Completely Fair Scheduler class + +// System call numbers (update these with actual numbers) +#define __NR_xsched_setattr 467 +#define __NR_xsched_getattr 468 + +// Wrapper functions for system calls +static inline long xsched_setattr(pid_t pid, const struct xsched_attr *attr) +{ + return syscall(__NR_xsched_setattr, pid, attr); +} + +static inline long xsched_getattr(pid_t pid, struct xsched_attr *attr) +{ + return syscall(__NR_xsched_getattr, pid, attr); +} + +void main(void) +{ + pid_t pid = getpid(); + struct xsched_attr attr; + long ret; + + // Get current configuration + ret = xsched_getattr(pid, &attr); + if (ret < 0) { + printf("Failed to get configuration!\n"); + } + + attr.xsched_class = XSCHED_TYPE_RT; + attr.xsched_priority = 3; + + ret = xsched_setattr(pid, &attr); + if (ret < 0) { + printf("Failed to set configuration\n"); + } + + // Verify the configuration + memset(&attr, 0, sizeof(attr)); + ret = xsched_getattr(pid, &attr); + if (ret < 0) { + printf("Failed to verify configuration!\n"); + } +} +``` + +### 2.3 调试日志 + +开启/关闭 XSched 调试日志 + +```shell +echo "file kernel/xsched/* +p" > /sys/kernel/debug/dynamic_debug/control +echo "file kernel/xsched/* -p" > /sys/kernel/debug/dynamic_debug/control +``` + +开启/关闭 NPU 驱动调试日志 + +```shell +echo "module ascend_trs_core +p" > /sys/kernel/debug/dynamic_debug/control +echo "module ascend_trs_pm_adapt +p" > /sys/kernel/debug/dynamic_debug/control +echo "module ascend_trs_core -p" > /sys/kernel/debug/dynamic_debug/control +echo "module ascend_trs_pm_adapt -p" > /sys/kernel/debug/dynamic_debug/control +``` -- 2.34.1

2 1

[PATCH 001/415] bpf: Add ability to pin bpf timer to calling CPU
by Luo Gengkun 14 Jan '26

14 Jan '26

From: David Vernet <void(a)manifault.com> mainline inclusion from mainline-v6.7-rc1 commit d6247ecb6c1e17d7a33317090627f5bfe563cbb2 category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8335 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- BPF supports creating high resolution timers using bpf_timer_* helper functions. Currently, only the BPF_F_TIMER_ABS flag is supported, which specifies that the timeout should be interpreted as absolute time. It would also be useful to be able to pin that timer to a core. For example, if you wanted to make a subset of cores run without timer interrupts, and only have the timer be invoked on a single core. This patch adds support for this with a new BPF_F_TIMER_CPU_PIN flag. When specified, the HRTIMER_MODE_PINNED flag is passed to hrtimer_start(). A subsequent patch will update selftests to validate. Signed-off-by: David Vernet <void(a)manifault.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: Song Liu <song(a)kernel.org> Acked-by: Hou Tao <houtao1(a)huawei.com> Link: https://lore.kernel.org/bpf/20231004162339.200702-2-void@manifault.com Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- include/uapi/linux/bpf.h | 4 ++++ kernel/bpf/helpers.c | 5 ++++- tools/include/uapi/linux/bpf.h | 4 ++++ 3 files changed, 12 insertions(+), 1 deletion(-) diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index 782d56c4ebca..3fa3f9b1a052 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -5122,6 +5122,8 @@ union bpf_attr { * **BPF_F_TIMER_ABS** * Start the timer in absolute expire value instead of the * default relative one. + * **BPF_F_TIMER_CPU_PIN** + * Timer will be pinned to the CPU of the caller. * * Return * 0 on success. @@ -7346,9 +7348,11 @@ struct bpf_core_relo { * Flags to control bpf_timer_start() behaviour. * - BPF_F_TIMER_ABS: Timeout passed is absolute time, by default it is * relative to current time. + * - BPF_F_TIMER_CPU_PIN: Timer will be pinned to the CPU of the caller. */ enum { BPF_F_TIMER_ABS = (1ULL << 0), + BPF_F_TIMER_CPU_PIN = (1ULL << 1), }; /* BPF numbers iterator state */ diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c index f40085f4de31..c889a9dee6c6 100644 --- a/kernel/bpf/helpers.c +++ b/kernel/bpf/helpers.c @@ -1363,7 +1363,7 @@ BPF_CALL_3(bpf_timer_start, struct bpf_async_kern *, timer, u64, nsecs, u64, fla if (in_nmi()) return -EOPNOTSUPP; - if (flags > BPF_F_TIMER_ABS) + if (flags & ~(BPF_F_TIMER_ABS | BPF_F_TIMER_CPU_PIN)) return -EINVAL; __bpf_spin_lock_irqsave(&timer->lock); t = timer->timer; @@ -1377,6 +1377,9 @@ BPF_CALL_3(bpf_timer_start, struct bpf_async_kern *, timer, u64, nsecs, u64, fla else mode = HRTIMER_MODE_REL_SOFT; + if (flags & BPF_F_TIMER_CPU_PIN) + mode |= HRTIMER_MODE_PINNED; + hrtimer_start(&t->timer, ns_to_ktime(nsecs), mode); out: __bpf_spin_unlock_irqrestore(&timer->lock); diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h index a457d4f82da2..fc0ed3b6abf1 100644 --- a/tools/include/uapi/linux/bpf.h +++ b/tools/include/uapi/linux/bpf.h @@ -5122,6 +5122,8 @@ union bpf_attr { * **BPF_F_TIMER_ABS** * Start the timer in absolute expire value instead of the * default relative one. + * **BPF_F_TIMER_CPU_PIN** + * Timer will be pinned to the CPU of the caller. * * Return * 0 on success. @@ -7349,9 +7351,11 @@ struct bpf_core_relo { * Flags to control bpf_timer_start() behaviour. * - BPF_F_TIMER_ABS: Timeout passed is absolute time, by default it is * relative to current time. + * - BPF_F_TIMER_CPU_PIN: Timer will be pinned to the CPU of the caller. */ enum { BPF_F_TIMER_ABS = (1ULL << 0), + BPF_F_TIMER_CPU_PIN = (1ULL << 1), }; /* BPF numbers iterator state */ -- 2.34.1

1 414

[PATCH OLK-6.6 0/2] CVE-2025-40099
by Wang Zhaolong 14 Jan '26

14 Jan '26

Eugene Korenevsky (1): cifs: parse_dfs_referrals: prevent oob on malformed input Paulo Alcantara (1): smb: client: fix return value of parse_dfs_referrals() fs/smb/client/misc.c | 21 +++++++++++++++++++-- fs/smb/client/smb2ops.c | 6 +++--- 2 files changed, 22 insertions(+), 5 deletions(-) -- 2.34.3

2 3

[PATCH OLK-6.6] cifs: client: fix memory leak in smb3_fs_context_parse_param
by Wang Zhaolong 14 Jan '26

14 Jan '26

From: Edward Adam Davis <eadavis(a)qq.com> stable inclusion from stable-v6.6.117 commit 868fc62811d3fabcf5685e14f36377a855d5412d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/12582 CVE: CVE-2025-40268 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e8c73eb7db0a498cd4b22d2819e6ab1a6f506bd6 upstream. The user calls fsconfig twice, but when the program exits, free() only frees ctx->source for the second fsconfig, not the first. Regarding fc->source, there is no code in the fs context related to its memory reclamation. To fix this memory leak, release the source memory corresponding to ctx or fc before each parsing. syzbot reported: BUG: memory leak unreferenced object 0xffff888128afa360 (size 96): backtrace (crc 79c9c7ba): kstrdup+0x3c/0x80 mm/util.c:84 smb3_fs_context_parse_param+0x229b/0x36c0 fs/smb/client/fs_context.c:1444 BUG: memory leak unreferenced object 0xffff888112c7d900 (size 96): backtrace (crc 79c9c7ba): smb3_fs_context_fullpath+0x70/0x1b0 fs/smb/client/fs_context.c:629 smb3_fs_context_parse_param+0x2266/0x36c0 fs/smb/client/fs_context.c:1438 Reported-by: syzbot+72afd4c236e6bc3f4bac(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=72afd4c236e6bc3f4bac Cc: stable(a)vger.kernel.org Reviewed-by: Paulo Alcantara (Red Hat) <pc(a)manguebit.org> Signed-off-by: Edward Adam Davis <eadavis(a)qq.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Zhaolong <wangzhaolong(a)huaweicloud.com> --- fs/smb/client/fs_context.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/smb/client/fs_context.c b/fs/smb/client/fs_context.c index 137d03781d52..cf233cb9c194 100644 --- a/fs/smb/client/fs_context.c +++ b/fs/smb/client/fs_context.c @@ -1359,16 +1359,18 @@ static int smb3_fs_context_parse_param(struct fs_context *fc, goto cifs_parse_mount_err; default: cifs_errorf(fc, "Unknown error parsing devname\n"); goto cifs_parse_mount_err; } + kfree(ctx->source); ctx->source = smb3_fs_context_fullpath(ctx, '/'); if (IS_ERR(ctx->source)) { ctx->source = NULL; cifs_errorf(fc, "OOM when copying UNC string\n"); goto cifs_parse_mount_err; } + kfree(fc->source); fc->source = kstrdup(ctx->source, GFP_KERNEL); if (fc->source == NULL) { cifs_errorf(fc, "OOM when copying UNC string\n"); goto cifs_parse_mount_err; } -- 2.34.3

2 1

[PATCH OLK-6.6] smb: client: fix potential cfid UAF in smb2_query_info_compound
by Wang Zhaolong 14 Jan '26

14 Jan '26

From: Henrique Carvalho <henrique.carvalho(a)suse.com> stable inclusion from stable-v6.6.117 commit 939c4e33005e2a56ea8fcedddf0da92df864bd3b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11308 CVE: CVE-2025-40320 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5c76f9961c170552c1d07c830b5e145475151600 upstream. When smb2_query_info_compound() retries, a previously allocated cfid may have been freed in the first attempt. Because cfid wasn't reset on replay, later cleanup could act on a stale pointer, leading to a potential use-after-free. Reinitialize cfid to NULL under the replay label. Example trace (trimmed): refcount_t: underflow; use-after-free. WARNING: CPU: 1 PID: 11224 at ../lib/refcount.c:28 refcount_warn_saturate+0x9c/0x110 [...] RIP: 0010:refcount_warn_saturate+0x9c/0x110 [...] Call Trace: <TASK> smb2_query_info_compound+0x29c/0x5c0 [cifs f90b72658819bd21c94769b6a652029a07a7172f] ? step_into+0x10d/0x690 ? __legitimize_path+0x28/0x60 smb2_queryfs+0x6a/0xf0 [cifs f90b72658819bd21c94769b6a652029a07a7172f] smb311_queryfs+0x12d/0x140 [cifs f90b72658819bd21c94769b6a652029a07a7172f] ? kmem_cache_alloc+0x18a/0x340 ? getname_flags+0x46/0x1e0 cifs_statfs+0x9f/0x2b0 [cifs f90b72658819bd21c94769b6a652029a07a7172f] statfs_by_dentry+0x67/0x90 vfs_statfs+0x16/0xd0 user_statfs+0x54/0xa0 __do_sys_statfs+0x20/0x50 do_syscall_64+0x58/0x80 Cc: stable(a)kernel.org Fixes: 4f1fffa237692 ("cifs: commands that are retried should have replay flag set") Reviewed-by: Paulo Alcantara (Red Hat) <pc(a)manguebit.com> Acked-by: Shyam Prasad N <sprasad(a)microsoft.com> Reviewed-by: Enzo Matsumiya <ematsumiya(a)suse.de> Signed-off-by: Henrique Carvalho <henrique.carvalho(a)suse.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Zhaolong <wangzhaolong(a)huaweicloud.com> --- fs/smb/client/smb2ops.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index c19643a37fa0..43c6d2f861f4 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -2655,15 +2655,16 @@ smb2_query_info_compound(const unsigned int xid, struct cifs_tcon *tcon, u8 oplock = SMB2_OPLOCK_LEVEL_NONE; struct cifs_open_parms oparms; struct cifs_fid fid; int rc; __le16 *utf16_path; - struct cached_fid *cfid = NULL; + struct cached_fid *cfid; int retries = 0, cur_sleep = 1; replay_again: /* reinitialize for possible replay */ + cfid = NULL; flags = CIFS_CP_CREATE_CLOSE_OP; oplock = SMB2_OPLOCK_LEVEL_NONE; server = cifs_pick_channel(ses); if (!path) -- 2.34.3

2 1

[PATCH] cifs: client: fix memory leak in smb3_fs_context_parse_param
by Wang Zhaolong 14 Jan '26

14 Jan '26

From: Edward Adam Davis <eadavis(a)qq.com> stable inclusion from stable-v6.6.117 commit 868fc62811d3fabcf5685e14f36377a855d5412d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/12582 CVE: CVE-2025-40268 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e8c73eb7db0a498cd4b22d2819e6ab1a6f506bd6 upstream. The user calls fsconfig twice, but when the program exits, free() only frees ctx->source for the second fsconfig, not the first. Regarding fc->source, there is no code in the fs context related to its memory reclamation. To fix this memory leak, release the source memory corresponding to ctx or fc before each parsing. syzbot reported: BUG: memory leak unreferenced object 0xffff888128afa360 (size 96): backtrace (crc 79c9c7ba): kstrdup+0x3c/0x80 mm/util.c:84 smb3_fs_context_parse_param+0x229b/0x36c0 fs/smb/client/fs_context.c:1444 BUG: memory leak unreferenced object 0xffff888112c7d900 (size 96): backtrace (crc 79c9c7ba): smb3_fs_context_fullpath+0x70/0x1b0 fs/smb/client/fs_context.c:629 smb3_fs_context_parse_param+0x2266/0x36c0 fs/smb/client/fs_context.c:1438 Reported-by: syzbot+72afd4c236e6bc3f4bac(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=72afd4c236e6bc3f4bac Cc: stable(a)vger.kernel.org Reviewed-by: Paulo Alcantara (Red Hat) <pc(a)manguebit.org> Signed-off-by: Edward Adam Davis <eadavis(a)qq.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Zhaolong <wangzhaolong(a)huaweicloud.com> --- fs/smb/client/fs_context.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/smb/client/fs_context.c b/fs/smb/client/fs_context.c index 137d03781d52..cf233cb9c194 100644 --- a/fs/smb/client/fs_context.c +++ b/fs/smb/client/fs_context.c @@ -1359,16 +1359,18 @@ static int smb3_fs_context_parse_param(struct fs_context *fc, goto cifs_parse_mount_err; default: cifs_errorf(fc, "Unknown error parsing devname\n"); goto cifs_parse_mount_err; } + kfree(ctx->source); ctx->source = smb3_fs_context_fullpath(ctx, '/'); if (IS_ERR(ctx->source)) { ctx->source = NULL; cifs_errorf(fc, "OOM when copying UNC string\n"); goto cifs_parse_mount_err; } + kfree(fc->source); fc->source = kstrdup(ctx->source, GFP_KERNEL); if (fc->source == NULL) { cifs_errorf(fc, "OOM when copying UNC string\n"); goto cifs_parse_mount_err; } -- 2.34.3

1 0

[PATCH OLK-6.6] smb: client: Fix refcount leak for cifs_sb_tlink
by Wang Zhaolong 14 Jan '26

14 Jan '26

From: Shuhao Fu <sfual(a)cse.ust.hk> mainline inclusion from mainline-v6.18-rc2 commit c2b77f42205ef485a647f62082c442c1cd69d3fc category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/7767 CVE: CVE-2025-40103 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fix three refcount inconsistency issues related to `cifs_sb_tlink`. Comments for `cifs_sb_tlink` state that `cifs_put_tlink()` needs to be called after successful calls to `cifs_sb_tlink()`. Three calls fail to update refcount accordingly, leading to possible resource leaks. Fixes: 8ceb98437946 ("CIFS: Move rename to ops struct") Fixes: 2f1afe25997f ("cifs: Use smb 2 - 3 and cifsacl mount options getacl functions") Fixes: 366ed846df60 ("cifs: Use smb 2 - 3 and cifsacl mount options setacl function") Cc: stable(a)vger.kernel.org Signed-off-by: Shuhao Fu <sfual(a)cse.ust.hk> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Wang Zhaolong <wangzhaolong(a)huaweicloud.com> --- fs/smb/client/inode.c | 6 ++++-- fs/smb/client/smb2ops.c | 8 ++++---- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c index 84d35a7c4e3b..108f5963e786 100644 --- a/fs/smb/client/inode.c +++ b/fs/smb/client/inode.c @@ -2305,12 +2305,14 @@ cifs_do_rename(const unsigned int xid, struct dentry *from_dentry, if (IS_ERR(tlink)) return PTR_ERR(tlink); tcon = tlink_tcon(tlink); server = tcon->ses->server; - if (!server->ops->rename) - return -ENOSYS; + if (!server->ops->rename) { + rc = -ENOSYS; + goto do_rename_exit; + } /* try path-based rename first */ rc = server->ops->rename(xid, tcon, from_dentry, from_path, to_path, cifs_sb); diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index c19643a37fa0..4950fa4550ae 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -3064,12 +3064,11 @@ get_smb2_acl_by_path(struct cifs_sb_info *cifs_sb, xid = get_xid(); utf16_path = cifs_convert_path_to_utf16(path, cifs_sb); if (!utf16_path) { rc = -ENOMEM; - free_xid(xid); - return ERR_PTR(rc); + goto put_tlink; } oparms = (struct cifs_open_parms) { .tcon = tcon, .path = path, @@ -3097,10 +3096,11 @@ get_smb2_acl_by_path(struct cifs_sb_info *cifs_sb, fid.volatile_fid, (void **)&pntsd, pacllen, info); SMB2_close(xid, tcon, fid.persistent_fid, fid.volatile_fid); } +put_tlink: cifs_put_tlink(tlink); free_xid(xid); cifs_dbg(FYI, "%s: rc = %d ACL len %d\n", __func__, rc, *pacllen); if (rc) @@ -3137,12 +3137,11 @@ set_smb2_acl(struct smb_ntsd *pnntsd, __u32 acllen, access_flags |= WRITE_DAC; utf16_path = cifs_convert_path_to_utf16(path, cifs_sb); if (!utf16_path) { rc = -ENOMEM; - free_xid(xid); - return rc; + goto put_tlink; } oparms = (struct cifs_open_parms) { .tcon = tcon, .desired_access = access_flags, @@ -3159,10 +3158,11 @@ set_smb2_acl(struct smb_ntsd *pnntsd, __u32 acllen, rc = SMB2_set_acl(xid, tlink_tcon(tlink), fid.persistent_fid, fid.volatile_fid, pnntsd, acllen, aclflag); SMB2_close(xid, tcon, fid.persistent_fid, fid.volatile_fid); } +put_tlink: cifs_put_tlink(tlink); free_xid(xid); return rc; } -- 2.34.3

2 1

[PATCH OLK-6.6] ceph: fix race condition validating r_parent before applying state
by Wang Zhaolong 14 Jan '26

14 Jan '26

From: Alex Markuze <amarkuze(a)redhat.com> mainline inclusion from mainline-v6.17-rc6 commit 15f519e9f883b316d86e2bb6b767a023aafd9d83 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/8352 CVE: CVE-2025-39927 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Add validation to ensure the cached parent directory inode matches the directory info in MDS replies. This prevents client-side race conditions where concurrent operations (e.g. rename) cause r_parent to become stale between request initiation and reply processing, which could lead to applying state changes to incorrect directory inodes. [ idryomov: folded a kerneldoc fixup and a follow-up fix from Alex to move CEPH_CAP_PIN reference when r_parent is updated: When the parent directory lock is not held, req->r_parent can become stale and is updated to point to the correct inode. However, the associated CEPH_CAP_PIN reference was not being adjusted. The CEPH_CAP_PIN is a reference on an inode that is tracked for accounting purposes. Moving this pin is important to keep the accounting balanced. When the pin was not moved from the old parent to the new one, it created two problems: The reference on the old, stale parent was never released, causing a reference leak. A reference for the new parent was never acquired, creating the risk of a reference underflow later in ceph_mdsc_release_request(). This patch corrects the logic by releasing the pin from the old parent and acquiring it for the new parent when r_parent is switched. This ensures reference accounting stays balanced. ] Cc: stable(a)vger.kernel.org Signed-off-by: Alex Markuze <amarkuze(a)redhat.com> Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Conflicts: fs/ceph/debugfs.c fs/ceph/dir.c fs/ceph/file.c fs/ceph/inode.c fs/ceph/mds_client.c fs/ceph/mds_client.h [The code has undergone multiple refactorings, leading to many context conflicts.] Signed-off-by: Wang Zhaolong <wangzhaolong(a)huaweicloud.com> --- fs/ceph/debugfs.c | 16 ++-- fs/ceph/dir.c | 10 +-- fs/ceph/file.c | 10 +-- fs/ceph/mds_client.c | 174 ++++++++++++++++++++++++++----------------- fs/ceph/mds_client.h | 18 ++++- 5 files changed, 136 insertions(+), 92 deletions(-) diff --git a/fs/ceph/debugfs.c b/fs/ceph/debugfs.c index 2f1e7498cd74..f00b333676d9 100644 --- a/fs/ceph/debugfs.c +++ b/fs/ceph/debugfs.c @@ -53,12 +53,10 @@ static int mdsc_show(struct seq_file *s, void *p) { struct ceph_fs_client *fsc = s->private; struct ceph_mds_client *mdsc = fsc->mdsc; struct ceph_mds_request *req; struct rb_node *rp; - int pathlen = 0; - u64 pathbase; char *path; mutex_lock(&mdsc->mutex); for (rp = rb_first(&mdsc->request_tree); rp; rp = rb_next(rp)) { req = rb_entry(rp, struct ceph_mds_request, r_node); @@ -79,41 +77,43 @@ static int mdsc_show(struct seq_file *s, void *p) seq_puts(s, "\t"); if (req->r_inode) { seq_printf(s, " #%llx", ceph_ino(req->r_inode)); } else if (req->r_dentry) { - path = ceph_mdsc_build_path(mdsc, req->r_dentry, &pathlen, - &pathbase, 0); + struct ceph_path_info path_info; + + path = ceph_mdsc_build_path(mdsc, req->r_dentry, &path_info, 0); if (IS_ERR(path)) path = NULL; spin_lock(&req->r_dentry->d_lock); seq_printf(s, " #%llx/%pd (%s)", ceph_ino(d_inode(req->r_dentry->d_parent)), req->r_dentry, path ? path : ""); spin_unlock(&req->r_dentry->d_lock); - ceph_mdsc_free_path(path, pathlen); + ceph_mdsc_free_path_info(&path_info); } else if (req->r_path1) { seq_printf(s, " #%llx/%s", req->r_ino1.ino, req->r_path1); } else { seq_printf(s, " #%llx", req->r_ino1.ino); } if (req->r_old_dentry) { - path = ceph_mdsc_build_path(mdsc, req->r_old_dentry, &pathlen, - &pathbase, 0); + struct ceph_path_info path_info; + + path = ceph_mdsc_build_path(mdsc, req->r_old_dentry, &path_info, 0); if (IS_ERR(path)) path = NULL; spin_lock(&req->r_old_dentry->d_lock); seq_printf(s, " #%llx/%pd (%s)", req->r_old_dentry_dir ? ceph_ino(req->r_old_dentry_dir) : 0, req->r_old_dentry, path ? path : ""); spin_unlock(&req->r_old_dentry->d_lock); - ceph_mdsc_free_path(path, pathlen); + ceph_mdsc_free_path_info(&path_info); } else if (req->r_path2 && req->r_op != CEPH_MDS_OP_SYMLINK) { if (req->r_ino2.ino) seq_printf(s, " #%llx/%s", req->r_ino2.ino, req->r_path2); else diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c index 1395b71df5cc..ebe6235bff4e 100644 --- a/fs/ceph/dir.c +++ b/fs/ceph/dir.c @@ -1222,14 +1222,12 @@ static void ceph_async_unlink_cb(struct ceph_mds_client *mdsc, if (result == -EJUKEBOX) goto out; /* If op failed, mark everyone involved for errors */ if (result) { - int pathlen = 0; - u64 base = 0; - char *path = ceph_mdsc_build_path(mdsc, dentry, &pathlen, - &base, 0); + struct ceph_path_info path_info = {0}; + char *path = ceph_mdsc_build_path(mdsc, dentry, &path_info, 0); /* mark error on parent + clear complete */ mapping_set_error(req->r_parent->i_mapping, result); ceph_dir_clear_complete(req->r_parent); @@ -1239,12 +1237,12 @@ static void ceph_async_unlink_cb(struct ceph_mds_client *mdsc, /* mark inode itself for an error (since metadata is bogus) */ mapping_set_error(req->r_old_inode->i_mapping, result); pr_warn("async unlink failure path=(%llx)%s result=%d!\n", - base, IS_ERR(path) ? "<<bad>>" : path, result); - ceph_mdsc_free_path(path, pathlen); + path_info.vino.ino, IS_ERR(path) ? "<<bad>>" : path, result); + ceph_mdsc_free_path_info(&path_info); } out: iput(req->r_old_inode); ceph_mdsc_release_dir_caps(req); } diff --git a/fs/ceph/file.c b/fs/ceph/file.c index 15f386a5d24c..eec5b573e6e1 100644 --- a/fs/ceph/file.c +++ b/fs/ceph/file.c @@ -571,18 +571,16 @@ static void ceph_async_create_cb(struct ceph_mds_client *mdsc, goto out; mapping_set_error(req->r_parent->i_mapping, result); if (result) { - int pathlen = 0; - u64 base = 0; - char *path = ceph_mdsc_build_path(mdsc, req->r_dentry, &pathlen, - &base, 0); + struct ceph_path_info path_info = {0}; + char *path = ceph_mdsc_build_path(mdsc, req->r_dentry, &path_info, 0); pr_warn("async create failure path=(%llx)%s result=%d!\n", - base, IS_ERR(path) ? "<<bad>>" : path, result); - ceph_mdsc_free_path(path, pathlen); + path_info.vino.ino, IS_ERR(path) ? "<<bad>>" : path, result); + ceph_mdsc_free_path_info(&path_info); ceph_dir_clear_complete(req->r_parent); if (!d_unhashed(dentry)) d_drop(dentry); diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c index dfa1b3c82b53..af3783ccd665 100644 --- a/fs/ceph/mds_client.c +++ b/fs/ceph/mds_client.c @@ -2589,12 +2589,11 @@ static u8 *get_fscrypt_altname(const struct ceph_mds_request *req, u32 *plen) /** * ceph_mdsc_build_path - build a path string to a given dentry * @mdsc: mds client * @dentry: dentry to which path should be built - * @plen: returned length of string - * @pbase: returned base inode number + * @path_info: output path, length, base ino+snap, and freepath ownership flag * @for_wire: is this path going to be sent to the MDS? * * Build a string that represents the path to the dentry. This is mostly called * for two different purposes: * @@ -2608,11 +2607,11 @@ static u8 *get_fscrypt_altname(const struct ceph_mds_request *req, u32 *plen) * * Encode hidden .snap dirs as a double /, i.e. * foo/.snap/bar -> foo//bar */ char *ceph_mdsc_build_path(struct ceph_mds_client *mdsc, struct dentry *dentry, - int *plen, u64 *pbase, int for_wire) + struct ceph_path_info *path_info, int for_wire) { struct dentry *cur; struct inode *inode; char *path; int pos; @@ -2718,92 +2717,115 @@ char *ceph_mdsc_build_path(struct ceph_mds_client *mdsc, struct dentry *dentry, * possible with Ceph, but Linux cannot use them. */ return ERR_PTR(-ENAMETOOLONG); } - *pbase = base; - *plen = PATH_MAX - 1 - pos; + /* Initialize the output structure */ + memset(path_info, 0, sizeof(*path_info)); + + path_info->vino.ino = base; + path_info->pathlen = PATH_MAX - 1 - pos; + path_info->path = path + pos; + path_info->freepath = true; + + /* Set snap from dentry if available */ + if (d_inode(dentry)) + path_info->vino.snap = ceph_snap(d_inode(dentry)); + else + path_info->vino.snap = CEPH_NOSNAP; + dout("build_path on %p %d built %llx '%.*s'\n", - dentry, d_count(dentry), base, *plen, path + pos); + dentry, d_count(dentry), base, PATH_MAX - 1 - pos, path + pos); return path + pos; } static int build_dentry_path(struct ceph_mds_client *mdsc, struct dentry *dentry, - struct inode *dir, const char **ppath, int *ppathlen, - u64 *pino, bool *pfreepath, bool parent_locked) + struct inode *dir, struct ceph_path_info *path_info, + bool parent_locked) { char *path; rcu_read_lock(); if (!dir) dir = d_inode_rcu(dentry->d_parent); if (dir && parent_locked && ceph_snap(dir) == CEPH_NOSNAP && !IS_ENCRYPTED(dir)) { - *pino = ceph_ino(dir); + path_info->vino.ino = ceph_ino(dir); + path_info->vino.snap = ceph_snap(dir); rcu_read_unlock(); - *ppath = dentry->d_name.name; - *ppathlen = dentry->d_name.len; + path_info->path = dentry->d_name.name; + path_info->pathlen = dentry->d_name.len; + path_info->freepath = false; return 0; } rcu_read_unlock(); - path = ceph_mdsc_build_path(mdsc, dentry, ppathlen, pino, 1); + path = ceph_mdsc_build_path(mdsc, dentry, path_info, 1); if (IS_ERR(path)) return PTR_ERR(path); - *ppath = path; - *pfreepath = true; + /* + * ceph_mdsc_build_path already fills path_info, including snap handling. + */ return 0; } -static int build_inode_path(struct inode *inode, - const char **ppath, int *ppathlen, u64 *pino, - bool *pfreepath) +static int build_inode_path(struct inode *inode, struct ceph_path_info *path_info) { struct ceph_mds_client *mdsc = ceph_sb_to_mdsc(inode->i_sb); struct dentry *dentry; char *path; if (ceph_snap(inode) == CEPH_NOSNAP) { - *pino = ceph_ino(inode); - *ppathlen = 0; + path_info->vino.ino = ceph_ino(inode); + path_info->vino.snap = ceph_snap(inode); + path_info->pathlen = 0; + path_info->freepath = false; return 0; } dentry = d_find_alias(inode); - path = ceph_mdsc_build_path(mdsc, dentry, ppathlen, pino, 1); + path = ceph_mdsc_build_path(mdsc, dentry, path_info, 1); dput(dentry); if (IS_ERR(path)) return PTR_ERR(path); - *ppath = path; - *pfreepath = true; + /* + * ceph_mdsc_build_path already fills path_info, including snap from dentry. + * Override with inode's snap since that's what this function is for. + */ + path_info->vino.snap = ceph_snap(inode); return 0; } /* * request arguments may be specified via an inode *, a dentry *, or * an explicit ino+path. */ static int set_request_path_attr(struct ceph_mds_client *mdsc, struct inode *rinode, struct dentry *rdentry, struct inode *rdiri, - const char *rpath, u64 rino, const char **ppath, - int *pathlen, u64 *ino, bool *freepath, + const char *rpath, u64 rino, + struct ceph_path_info *path_info, bool parent_locked) { int r = 0; + /* Initialize the output structure */ + memset(path_info, 0, sizeof(*path_info)); + if (rinode) { - r = build_inode_path(rinode, ppath, pathlen, ino, freepath); + r = build_inode_path(rinode, path_info); dout(" inode %p %llx.%llx\n", rinode, ceph_ino(rinode), ceph_snap(rinode)); } else if (rdentry) { - r = build_dentry_path(mdsc, rdentry, rdiri, ppath, pathlen, ino, - freepath, parent_locked); - dout(" dentry %p %llx/%.*s\n", rdentry, *ino, *pathlen, - *ppath); + r = build_dentry_path(mdsc, rdentry, rdiri, path_info, parent_locked); + dout(" dentry %p %llx/%.*s\n", rdentry, path_info->vino.ino, + path_info->pathlen, path_info->path); } else if (rpath || rino) { - *ino = rino; - *ppath = rpath; - *pathlen = rpath ? strlen(rpath) : 0; - dout(" path %.*s\n", *pathlen, rpath); + path_info->vino.ino = rino; + path_info->vino.snap = CEPH_NOSNAP; + path_info->path = rpath; + path_info->pathlen = rpath ? strlen(rpath) : 0; + path_info->freepath = false; + + dout(" path %.*s\n", path_info->pathlen, rpath); } return r; } @@ -2864,42 +2886,64 @@ static struct ceph_msg *create_request_message(struct ceph_mds_session *session, { int mds = session->s_mds; struct ceph_mds_client *mdsc = session->s_mdsc; struct ceph_msg *msg; struct ceph_mds_request_head_legacy *lhead; - const char *path1 = NULL; - const char *path2 = NULL; - u64 ino1 = 0, ino2 = 0; - int pathlen1 = 0, pathlen2 = 0; - bool freepath1 = false, freepath2 = false; + struct ceph_path_info path_info1 = {0}; + struct ceph_path_info path_info2 = {0}; struct dentry *old_dentry = NULL; int len; u16 releases; void *p, *end; int ret; bool legacy = !(session->s_con.peer_features & CEPH_FEATURE_FS_BTIME); bool old_version = !test_bit(CEPHFS_FEATURE_32BITS_RETRY_FWD, &session->s_features); + bool parent_locked = test_bit(CEPH_MDS_R_PARENT_LOCKED, &req->r_req_flags); ret = set_request_path_attr(mdsc, req->r_inode, req->r_dentry, - req->r_parent, req->r_path1, req->r_ino1.ino, - &path1, &pathlen1, &ino1, &freepath1, - test_bit(CEPH_MDS_R_PARENT_LOCKED, - &req->r_req_flags)); + req->r_parent, req->r_path1, req->r_ino1.ino, + &path_info1, parent_locked); if (ret < 0) { msg = ERR_PTR(ret); goto out; } + /* + * When the parent directory's i_rwsem is *not* locked, req->r_parent may + * have become stale (e.g. after a concurrent rename) between the time the + * dentry was looked up and now. If we detect that the stored r_parent + * does not match the inode number we just encoded for the request, switch + * to the correct inode so that the MDS receives a valid parent reference. + */ + if (!parent_locked && req->r_parent && path_info1.vino.ino && + ceph_ino(req->r_parent) != path_info1.vino.ino) { + struct inode *old_parent = req->r_parent; + struct inode *correct_dir = ceph_get_inode(mdsc->fsc->sb, path_info1.vino, NULL); + + if (!IS_ERR(correct_dir)) { + WARN_ONCE(1, "ceph: r_parent mismatch (had %llx wanted %llx) - updating\n", + ceph_ino(old_parent), path_info1.vino.ino); + /* + * Transfer CEPH_CAP_PIN from the old parent to the new one. + * The pin was taken earlier in ceph_mdsc_submit_request(). + */ + ceph_put_cap_refs(ceph_inode(old_parent), CEPH_CAP_PIN); + iput(old_parent); + req->r_parent = correct_dir; + ceph_get_cap_refs(ceph_inode(req->r_parent), CEPH_CAP_PIN); + } + } + /* If r_old_dentry is set, then assume that its parent is locked */ if (req->r_old_dentry && !(req->r_old_dentry->d_flags & DCACHE_DISCONNECTED)) old_dentry = req->r_old_dentry; ret = set_request_path_attr(mdsc, NULL, old_dentry, - req->r_old_dentry_dir, - req->r_path2, req->r_ino2.ino, - &path2, &pathlen2, &ino2, &freepath2, true); + req->r_old_dentry_dir, + req->r_path2, req->r_ino2.ino, + &path_info2, true); if (ret < 0) { msg = ERR_PTR(ret); goto out_free1; } @@ -2924,21 +2968,21 @@ static struct ceph_msg *create_request_message(struct ceph_mds_session *session, else len = sizeof(struct ceph_mds_request_head); /* filepaths */ len += 2 * (1 + sizeof(u32) + sizeof(u64)); - len += pathlen1 + pathlen2; + len += path_info1.pathlen + path_info2.pathlen; /* cap releases */ len += sizeof(struct ceph_mds_request_release) * (!!req->r_inode_drop + !!req->r_dentry_drop + !!req->r_old_inode_drop + !!req->r_old_dentry_drop); if (req->r_dentry_drop) - len += pathlen1; + len += path_info1.pathlen; if (req->r_old_dentry_drop) - len += pathlen2; + len += path_info2.pathlen; /* MClientRequest tail */ /* req->r_stamp */ len += sizeof(struct ceph_timespec); @@ -3000,12 +3044,12 @@ static struct ceph_msg *create_request_message(struct ceph_mds_session *session, lhead->caller_gid = cpu_to_le32(from_kgid(&init_user_ns, req->r_cred->fsgid)); lhead->ino = cpu_to_le64(req->r_deleg_ino); lhead->args = req->r_args; - ceph_encode_filepath(&p, end, ino1, path1); - ceph_encode_filepath(&p, end, ino2, path2); + ceph_encode_filepath(&p, end, path_info1.vino.ino, path_info1.path); + ceph_encode_filepath(&p, end, path_info2.vino.ino, path_info2.path); /* make note of release offset, in case we need to replay */ req->r_request_release_offset = p - msg->front.iov_base; /* cap releases */ @@ -3064,15 +3108,13 @@ static struct ceph_msg *create_request_message(struct ceph_mds_session *session, } msg->hdr.data_off = cpu_to_le16(0); out_free2: - if (freepath2) - ceph_mdsc_free_path((char *)path2, pathlen2); + ceph_mdsc_free_path_info(&path_info2); out_free1: - if (freepath1) - ceph_mdsc_free_path((char *)path1, pathlen1); + ceph_mdsc_free_path_info(&path_info1); out: return msg; out_err: ceph_msg_put(msg); msg = ERR_PTR(ret); @@ -4301,28 +4343,24 @@ static int reconnect_caps_cb(struct inode *inode, int mds, void *arg) struct ceph_inode_info *ci = ceph_inode(inode); struct ceph_reconnect_state *recon_state = arg; struct ceph_pagelist *pagelist = recon_state->pagelist; struct dentry *dentry; struct ceph_cap *cap; - char *path; - int pathlen = 0, err; - u64 pathbase; + struct ceph_path_info path_info = {0}; + int err; u64 snap_follows; dentry = d_find_primary(inode); if (dentry) { /* set pathbase to parent dir when msg_version >= 2 */ - path = ceph_mdsc_build_path(mdsc, dentry, &pathlen, &pathbase, + char *path = ceph_mdsc_build_path(mdsc, dentry, &path_info, recon_state->msg_version >= 2); dput(dentry); if (IS_ERR(path)) { err = PTR_ERR(path); goto out_err; } - } else { - path = NULL; - pathbase = 0; } spin_lock(&ci->i_ceph_lock); cap = __get_cap_for_mds(ci, mds); if (!cap) { @@ -4351,22 +4389,22 @@ static int reconnect_caps_cb(struct inode *inode, int mds, void *arg) if (recon_state->msg_version >= 2) { rec.v2.cap_id = cpu_to_le64(cap->cap_id); rec.v2.wanted = cpu_to_le32(__ceph_caps_wanted(ci)); rec.v2.issued = cpu_to_le32(cap->issued); rec.v2.snaprealm = cpu_to_le64(ci->i_snap_realm->ino); - rec.v2.pathbase = cpu_to_le64(pathbase); + rec.v2.pathbase = cpu_to_le64(path_info.vino.ino); rec.v2.flock_len = (__force __le32) ((ci->i_ceph_flags & CEPH_I_ERROR_FILELOCK) ? 0 : 1); } else { rec.v1.cap_id = cpu_to_le64(cap->cap_id); rec.v1.wanted = cpu_to_le32(__ceph_caps_wanted(ci)); rec.v1.issued = cpu_to_le32(cap->issued); rec.v1.size = cpu_to_le64(i_size_read(inode)); ceph_encode_timespec64(&rec.v1.mtime, &inode->i_mtime); ceph_encode_timespec64(&rec.v1.atime, &inode->i_atime); rec.v1.snaprealm = cpu_to_le64(ci->i_snap_realm->ino); - rec.v1.pathbase = cpu_to_le64(pathbase); + rec.v1.pathbase = cpu_to_le64(path_info.vino.ino); } if (list_empty(&ci->i_cap_snaps)) { snap_follows = ci->i_head_snapc ? ci->i_head_snapc->seq : 0; } else { @@ -4424,11 +4462,11 @@ static int reconnect_caps_cb(struct inode *inode, int mds, void *arg) struct_len = 2 * sizeof(u32) + (num_fcntl_locks + num_flock_locks) * sizeof(struct ceph_filelock); rec.v2.flock_len = cpu_to_le32(struct_len); - struct_len += sizeof(u32) + pathlen + sizeof(rec.v2); + struct_len += sizeof(u32) + path_info.pathlen + sizeof(rec.v2); if (struct_v >= 2) struct_len += sizeof(u64); /* snap_follows */ total_len += struct_len; @@ -4448,32 +4486,32 @@ static int reconnect_caps_cb(struct inode *inode, int mds, void *arg) if (recon_state->msg_version >= 3) { ceph_pagelist_encode_8(pagelist, struct_v); ceph_pagelist_encode_8(pagelist, 1); ceph_pagelist_encode_32(pagelist, struct_len); } - ceph_pagelist_encode_string(pagelist, path, pathlen); + ceph_pagelist_encode_string(pagelist, (char *)path_info.path, path_info.pathlen); ceph_pagelist_append(pagelist, &rec, sizeof(rec.v2)); ceph_locks_to_pagelist(flocks, pagelist, num_fcntl_locks, num_flock_locks); if (struct_v >= 2) ceph_pagelist_encode_64(pagelist, snap_follows); out_freeflocks: kfree(flocks); } else { err = ceph_pagelist_reserve(pagelist, sizeof(u64) + sizeof(u32) + - pathlen + sizeof(rec.v1)); + path_info.pathlen + sizeof(rec.v1)); if (err) goto out_err; ceph_pagelist_encode_64(pagelist, ceph_ino(inode)); - ceph_pagelist_encode_string(pagelist, path, pathlen); + ceph_pagelist_encode_string(pagelist, (char *)path_info.path, path_info.pathlen); ceph_pagelist_append(pagelist, &rec, sizeof(rec.v1)); } out_err: - ceph_mdsc_free_path(path, pathlen); + ceph_mdsc_free_path_info(&path_info); if (!err) recon_state->nr_caps++; return err; } diff --git a/fs/ceph/mds_client.h b/fs/ceph/mds_client.h index d930eb79dc38..66bc179413f3 100644 --- a/fs/ceph/mds_client.h +++ b/fs/ceph/mds_client.h @@ -573,18 +573,28 @@ extern void ceph_reclaim_caps_nr(struct ceph_mds_client *mdsc, int nr); extern int ceph_iterate_session_caps(struct ceph_mds_session *session, int (*cb)(struct inode *, int mds, void *), void *arg); extern void ceph_mdsc_pre_umount(struct ceph_mds_client *mdsc); -static inline void ceph_mdsc_free_path(char *path, int len) +/* + * Structure to group path-related output parameters for build_*_path functions + */ +struct ceph_path_info { + const char *path; + int pathlen; + struct ceph_vino vino; + bool freepath; +}; + +static inline void ceph_mdsc_free_path_info(const struct ceph_path_info *path_info) { - if (!IS_ERR_OR_NULL(path)) - __putname(path - (PATH_MAX - 1 - len)); + if (path_info && path_info->freepath && !IS_ERR_OR_NULL(path_info->path)) + __putname((char *)path_info->path - (PATH_MAX - 1 - path_info->pathlen)); } extern char *ceph_mdsc_build_path(struct ceph_mds_client *mdsc, - struct dentry *dentry, int *plen, u64 *base, + struct dentry *dentry, struct ceph_path_info *path_info, int for_wire); extern void __ceph_mdsc_drop_dentry_lease(struct dentry *dentry); extern void ceph_mdsc_lease_send_msg(struct ceph_mds_session *session, struct dentry *dentry, char action, -- 2.34.3

2 1

[PATCH OLK-6.6] ceph: fix race condition validating r_parent before applying state
by Wang Zhaolong 14 Jan '26

14 Jan '26

From: Alex Markuze <amarkuze(a)redhat.com> mainline inclusion from mainline-v6.17-rc6 commit 15f519e9f883b316d86e2bb6b767a023aafd9d83 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID0R58 CVE: CVE-2025-39927 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Add validation to ensure the cached parent directory inode matches the directory info in MDS replies. This prevents client-side race conditions where concurrent operations (e.g. rename) cause r_parent to become stale between request initiation and reply processing, which could lead to applying state changes to incorrect directory inodes. [ idryomov: folded a kerneldoc fixup and a follow-up fix from Alex to move CEPH_CAP_PIN reference when r_parent is updated: When the parent directory lock is not held, req->r_parent can become stale and is updated to point to the correct inode. However, the associated CEPH_CAP_PIN reference was not being adjusted. The CEPH_CAP_PIN is a reference on an inode that is tracked for accounting purposes. Moving this pin is important to keep the accounting balanced. When the pin was not moved from the old parent to the new one, it created two problems: The reference on the old, stale parent was never released, causing a reference leak. A reference for the new parent was never acquired, creating the risk of a reference underflow later in ceph_mdsc_release_request(). This patch corrects the logic by releasing the pin from the old parent and acquiring it for the new parent when r_parent is switched. This ensures reference accounting stays balanced. ] Cc: stable(a)vger.kernel.org Signed-off-by: Alex Markuze <amarkuze(a)redhat.com> Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Conflicts: fs/ceph/debugfs.c fs/ceph/dir.c fs/ceph/file.c fs/ceph/inode.c fs/ceph/mds_client.c fs/ceph/mds_client.h [The code has undergone multiple refactorings, leading to many context conflicts.] Signed-off-by: Wang Zhaolong <wangzhaolong(a)huaweicloud.com> --- fs/ceph/debugfs.c | 16 ++-- fs/ceph/dir.c | 10 +-- fs/ceph/file.c | 10 +-- fs/ceph/mds_client.c | 174 ++++++++++++++++++++++++++----------------- fs/ceph/mds_client.h | 18 ++++- 5 files changed, 136 insertions(+), 92 deletions(-) diff --git a/fs/ceph/debugfs.c b/fs/ceph/debugfs.c index 2f1e7498cd74..f00b333676d9 100644 --- a/fs/ceph/debugfs.c +++ b/fs/ceph/debugfs.c @@ -53,12 +53,10 @@ static int mdsc_show(struct seq_file *s, void *p) { struct ceph_fs_client *fsc = s->private; struct ceph_mds_client *mdsc = fsc->mdsc; struct ceph_mds_request *req; struct rb_node *rp; - int pathlen = 0; - u64 pathbase; char *path; mutex_lock(&mdsc->mutex); for (rp = rb_first(&mdsc->request_tree); rp; rp = rb_next(rp)) { req = rb_entry(rp, struct ceph_mds_request, r_node); @@ -79,41 +77,43 @@ static int mdsc_show(struct seq_file *s, void *p) seq_puts(s, "\t"); if (req->r_inode) { seq_printf(s, " #%llx", ceph_ino(req->r_inode)); } else if (req->r_dentry) { - path = ceph_mdsc_build_path(mdsc, req->r_dentry, &pathlen, - &pathbase, 0); + struct ceph_path_info path_info; + + path = ceph_mdsc_build_path(mdsc, req->r_dentry, &path_info, 0); if (IS_ERR(path)) path = NULL; spin_lock(&req->r_dentry->d_lock); seq_printf(s, " #%llx/%pd (%s)", ceph_ino(d_inode(req->r_dentry->d_parent)), req->r_dentry, path ? path : ""); spin_unlock(&req->r_dentry->d_lock); - ceph_mdsc_free_path(path, pathlen); + ceph_mdsc_free_path_info(&path_info); } else if (req->r_path1) { seq_printf(s, " #%llx/%s", req->r_ino1.ino, req->r_path1); } else { seq_printf(s, " #%llx", req->r_ino1.ino); } if (req->r_old_dentry) { - path = ceph_mdsc_build_path(mdsc, req->r_old_dentry, &pathlen, - &pathbase, 0); + struct ceph_path_info path_info; + + path = ceph_mdsc_build_path(mdsc, req->r_old_dentry, &path_info, 0); if (IS_ERR(path)) path = NULL; spin_lock(&req->r_old_dentry->d_lock); seq_printf(s, " #%llx/%pd (%s)", req->r_old_dentry_dir ? ceph_ino(req->r_old_dentry_dir) : 0, req->r_old_dentry, path ? path : ""); spin_unlock(&req->r_old_dentry->d_lock); - ceph_mdsc_free_path(path, pathlen); + ceph_mdsc_free_path_info(&path_info); } else if (req->r_path2 && req->r_op != CEPH_MDS_OP_SYMLINK) { if (req->r_ino2.ino) seq_printf(s, " #%llx/%s", req->r_ino2.ino, req->r_path2); else diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c index 1395b71df5cc..ebe6235bff4e 100644 --- a/fs/ceph/dir.c +++ b/fs/ceph/dir.c @@ -1222,14 +1222,12 @@ static void ceph_async_unlink_cb(struct ceph_mds_client *mdsc, if (result == -EJUKEBOX) goto out; /* If op failed, mark everyone involved for errors */ if (result) { - int pathlen = 0; - u64 base = 0; - char *path = ceph_mdsc_build_path(mdsc, dentry, &pathlen, - &base, 0); + struct ceph_path_info path_info = {0}; + char *path = ceph_mdsc_build_path(mdsc, dentry, &path_info, 0); /* mark error on parent + clear complete */ mapping_set_error(req->r_parent->i_mapping, result); ceph_dir_clear_complete(req->r_parent); @@ -1239,12 +1237,12 @@ static void ceph_async_unlink_cb(struct ceph_mds_client *mdsc, /* mark inode itself for an error (since metadata is bogus) */ mapping_set_error(req->r_old_inode->i_mapping, result); pr_warn("async unlink failure path=(%llx)%s result=%d!\n", - base, IS_ERR(path) ? "<<bad>>" : path, result); - ceph_mdsc_free_path(path, pathlen); + path_info.vino.ino, IS_ERR(path) ? "<<bad>>" : path, result); + ceph_mdsc_free_path_info(&path_info); } out: iput(req->r_old_inode); ceph_mdsc_release_dir_caps(req); } diff --git a/fs/ceph/file.c b/fs/ceph/file.c index 15f386a5d24c..eec5b573e6e1 100644 --- a/fs/ceph/file.c +++ b/fs/ceph/file.c @@ -571,18 +571,16 @@ static void ceph_async_create_cb(struct ceph_mds_client *mdsc, goto out; mapping_set_error(req->r_parent->i_mapping, result); if (result) { - int pathlen = 0; - u64 base = 0; - char *path = ceph_mdsc_build_path(mdsc, req->r_dentry, &pathlen, - &base, 0); + struct ceph_path_info path_info = {0}; + char *path = ceph_mdsc_build_path(mdsc, req->r_dentry, &path_info, 0); pr_warn("async create failure path=(%llx)%s result=%d!\n", - base, IS_ERR(path) ? "<<bad>>" : path, result); - ceph_mdsc_free_path(path, pathlen); + path_info.vino.ino, IS_ERR(path) ? "<<bad>>" : path, result); + ceph_mdsc_free_path_info(&path_info); ceph_dir_clear_complete(req->r_parent); if (!d_unhashed(dentry)) d_drop(dentry); diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c index dfa1b3c82b53..af3783ccd665 100644 --- a/fs/ceph/mds_client.c +++ b/fs/ceph/mds_client.c @@ -2589,12 +2589,11 @@ static u8 *get_fscrypt_altname(const struct ceph_mds_request *req, u32 *plen) /** * ceph_mdsc_build_path - build a path string to a given dentry * @mdsc: mds client * @dentry: dentry to which path should be built - * @plen: returned length of string - * @pbase: returned base inode number + * @path_info: output path, length, base ino+snap, and freepath ownership flag * @for_wire: is this path going to be sent to the MDS? * * Build a string that represents the path to the dentry. This is mostly called * for two different purposes: * @@ -2608,11 +2607,11 @@ static u8 *get_fscrypt_altname(const struct ceph_mds_request *req, u32 *plen) * * Encode hidden .snap dirs as a double /, i.e. * foo/.snap/bar -> foo//bar */ char *ceph_mdsc_build_path(struct ceph_mds_client *mdsc, struct dentry *dentry, - int *plen, u64 *pbase, int for_wire) + struct ceph_path_info *path_info, int for_wire) { struct dentry *cur; struct inode *inode; char *path; int pos; @@ -2718,92 +2717,115 @@ char *ceph_mdsc_build_path(struct ceph_mds_client *mdsc, struct dentry *dentry, * possible with Ceph, but Linux cannot use them. */ return ERR_PTR(-ENAMETOOLONG); } - *pbase = base; - *plen = PATH_MAX - 1 - pos; + /* Initialize the output structure */ + memset(path_info, 0, sizeof(*path_info)); + + path_info->vino.ino = base; + path_info->pathlen = PATH_MAX - 1 - pos; + path_info->path = path + pos; + path_info->freepath = true; + + /* Set snap from dentry if available */ + if (d_inode(dentry)) + path_info->vino.snap = ceph_snap(d_inode(dentry)); + else + path_info->vino.snap = CEPH_NOSNAP; + dout("build_path on %p %d built %llx '%.*s'\n", - dentry, d_count(dentry), base, *plen, path + pos); + dentry, d_count(dentry), base, PATH_MAX - 1 - pos, path + pos); return path + pos; } static int build_dentry_path(struct ceph_mds_client *mdsc, struct dentry *dentry, - struct inode *dir, const char **ppath, int *ppathlen, - u64 *pino, bool *pfreepath, bool parent_locked) + struct inode *dir, struct ceph_path_info *path_info, + bool parent_locked) { char *path; rcu_read_lock(); if (!dir) dir = d_inode_rcu(dentry->d_parent); if (dir && parent_locked && ceph_snap(dir) == CEPH_NOSNAP && !IS_ENCRYPTED(dir)) { - *pino = ceph_ino(dir); + path_info->vino.ino = ceph_ino(dir); + path_info->vino.snap = ceph_snap(dir); rcu_read_unlock(); - *ppath = dentry->d_name.name; - *ppathlen = dentry->d_name.len; + path_info->path = dentry->d_name.name; + path_info->pathlen = dentry->d_name.len; + path_info->freepath = false; return 0; } rcu_read_unlock(); - path = ceph_mdsc_build_path(mdsc, dentry, ppathlen, pino, 1); + path = ceph_mdsc_build_path(mdsc, dentry, path_info, 1); if (IS_ERR(path)) return PTR_ERR(path); - *ppath = path; - *pfreepath = true; + /* + * ceph_mdsc_build_path already fills path_info, including snap handling. + */ return 0; } -static int build_inode_path(struct inode *inode, - const char **ppath, int *ppathlen, u64 *pino, - bool *pfreepath) +static int build_inode_path(struct inode *inode, struct ceph_path_info *path_info) { struct ceph_mds_client *mdsc = ceph_sb_to_mdsc(inode->i_sb); struct dentry *dentry; char *path; if (ceph_snap(inode) == CEPH_NOSNAP) { - *pino = ceph_ino(inode); - *ppathlen = 0; + path_info->vino.ino = ceph_ino(inode); + path_info->vino.snap = ceph_snap(inode); + path_info->pathlen = 0; + path_info->freepath = false; return 0; } dentry = d_find_alias(inode); - path = ceph_mdsc_build_path(mdsc, dentry, ppathlen, pino, 1); + path = ceph_mdsc_build_path(mdsc, dentry, path_info, 1); dput(dentry); if (IS_ERR(path)) return PTR_ERR(path); - *ppath = path; - *pfreepath = true; + /* + * ceph_mdsc_build_path already fills path_info, including snap from dentry. + * Override with inode's snap since that's what this function is for. + */ + path_info->vino.snap = ceph_snap(inode); return 0; } /* * request arguments may be specified via an inode *, a dentry *, or * an explicit ino+path. */ static int set_request_path_attr(struct ceph_mds_client *mdsc, struct inode *rinode, struct dentry *rdentry, struct inode *rdiri, - const char *rpath, u64 rino, const char **ppath, - int *pathlen, u64 *ino, bool *freepath, + const char *rpath, u64 rino, + struct ceph_path_info *path_info, bool parent_locked) { int r = 0; + /* Initialize the output structure */ + memset(path_info, 0, sizeof(*path_info)); + if (rinode) { - r = build_inode_path(rinode, ppath, pathlen, ino, freepath); + r = build_inode_path(rinode, path_info); dout(" inode %p %llx.%llx\n", rinode, ceph_ino(rinode), ceph_snap(rinode)); } else if (rdentry) { - r = build_dentry_path(mdsc, rdentry, rdiri, ppath, pathlen, ino, - freepath, parent_locked); - dout(" dentry %p %llx/%.*s\n", rdentry, *ino, *pathlen, - *ppath); + r = build_dentry_path(mdsc, rdentry, rdiri, path_info, parent_locked); + dout(" dentry %p %llx/%.*s\n", rdentry, path_info->vino.ino, + path_info->pathlen, path_info->path); } else if (rpath || rino) { - *ino = rino; - *ppath = rpath; - *pathlen = rpath ? strlen(rpath) : 0; - dout(" path %.*s\n", *pathlen, rpath); + path_info->vino.ino = rino; + path_info->vino.snap = CEPH_NOSNAP; + path_info->path = rpath; + path_info->pathlen = rpath ? strlen(rpath) : 0; + path_info->freepath = false; + + dout(" path %.*s\n", path_info->pathlen, rpath); } return r; } @@ -2864,42 +2886,64 @@ static struct ceph_msg *create_request_message(struct ceph_mds_session *session, { int mds = session->s_mds; struct ceph_mds_client *mdsc = session->s_mdsc; struct ceph_msg *msg; struct ceph_mds_request_head_legacy *lhead; - const char *path1 = NULL; - const char *path2 = NULL; - u64 ino1 = 0, ino2 = 0; - int pathlen1 = 0, pathlen2 = 0; - bool freepath1 = false, freepath2 = false; + struct ceph_path_info path_info1 = {0}; + struct ceph_path_info path_info2 = {0}; struct dentry *old_dentry = NULL; int len; u16 releases; void *p, *end; int ret; bool legacy = !(session->s_con.peer_features & CEPH_FEATURE_FS_BTIME); bool old_version = !test_bit(CEPHFS_FEATURE_32BITS_RETRY_FWD, &session->s_features); + bool parent_locked = test_bit(CEPH_MDS_R_PARENT_LOCKED, &req->r_req_flags); ret = set_request_path_attr(mdsc, req->r_inode, req->r_dentry, - req->r_parent, req->r_path1, req->r_ino1.ino, - &path1, &pathlen1, &ino1, &freepath1, - test_bit(CEPH_MDS_R_PARENT_LOCKED, - &req->r_req_flags)); + req->r_parent, req->r_path1, req->r_ino1.ino, + &path_info1, parent_locked); if (ret < 0) { msg = ERR_PTR(ret); goto out; } + /* + * When the parent directory's i_rwsem is *not* locked, req->r_parent may + * have become stale (e.g. after a concurrent rename) between the time the + * dentry was looked up and now. If we detect that the stored r_parent + * does not match the inode number we just encoded for the request, switch + * to the correct inode so that the MDS receives a valid parent reference. + */ + if (!parent_locked && req->r_parent && path_info1.vino.ino && + ceph_ino(req->r_parent) != path_info1.vino.ino) { + struct inode *old_parent = req->r_parent; + struct inode *correct_dir = ceph_get_inode(mdsc->fsc->sb, path_info1.vino, NULL); + + if (!IS_ERR(correct_dir)) { + WARN_ONCE(1, "ceph: r_parent mismatch (had %llx wanted %llx) - updating\n", + ceph_ino(old_parent), path_info1.vino.ino); + /* + * Transfer CEPH_CAP_PIN from the old parent to the new one. + * The pin was taken earlier in ceph_mdsc_submit_request(). + */ + ceph_put_cap_refs(ceph_inode(old_parent), CEPH_CAP_PIN); + iput(old_parent); + req->r_parent = correct_dir; + ceph_get_cap_refs(ceph_inode(req->r_parent), CEPH_CAP_PIN); + } + } + /* If r_old_dentry is set, then assume that its parent is locked */ if (req->r_old_dentry && !(req->r_old_dentry->d_flags & DCACHE_DISCONNECTED)) old_dentry = req->r_old_dentry; ret = set_request_path_attr(mdsc, NULL, old_dentry, - req->r_old_dentry_dir, - req->r_path2, req->r_ino2.ino, - &path2, &pathlen2, &ino2, &freepath2, true); + req->r_old_dentry_dir, + req->r_path2, req->r_ino2.ino, + &path_info2, true); if (ret < 0) { msg = ERR_PTR(ret); goto out_free1; } @@ -2924,21 +2968,21 @@ static struct ceph_msg *create_request_message(struct ceph_mds_session *session, else len = sizeof(struct ceph_mds_request_head); /* filepaths */ len += 2 * (1 + sizeof(u32) + sizeof(u64)); - len += pathlen1 + pathlen2; + len += path_info1.pathlen + path_info2.pathlen; /* cap releases */ len += sizeof(struct ceph_mds_request_release) * (!!req->r_inode_drop + !!req->r_dentry_drop + !!req->r_old_inode_drop + !!req->r_old_dentry_drop); if (req->r_dentry_drop) - len += pathlen1; + len += path_info1.pathlen; if (req->r_old_dentry_drop) - len += pathlen2; + len += path_info2.pathlen; /* MClientRequest tail */ /* req->r_stamp */ len += sizeof(struct ceph_timespec); @@ -3000,12 +3044,12 @@ static struct ceph_msg *create_request_message(struct ceph_mds_session *session, lhead->caller_gid = cpu_to_le32(from_kgid(&init_user_ns, req->r_cred->fsgid)); lhead->ino = cpu_to_le64(req->r_deleg_ino); lhead->args = req->r_args; - ceph_encode_filepath(&p, end, ino1, path1); - ceph_encode_filepath(&p, end, ino2, path2); + ceph_encode_filepath(&p, end, path_info1.vino.ino, path_info1.path); + ceph_encode_filepath(&p, end, path_info2.vino.ino, path_info2.path); /* make note of release offset, in case we need to replay */ req->r_request_release_offset = p - msg->front.iov_base; /* cap releases */ @@ -3064,15 +3108,13 @@ static struct ceph_msg *create_request_message(struct ceph_mds_session *session, } msg->hdr.data_off = cpu_to_le16(0); out_free2: - if (freepath2) - ceph_mdsc_free_path((char *)path2, pathlen2); + ceph_mdsc_free_path_info(&path_info2); out_free1: - if (freepath1) - ceph_mdsc_free_path((char *)path1, pathlen1); + ceph_mdsc_free_path_info(&path_info1); out: return msg; out_err: ceph_msg_put(msg); msg = ERR_PTR(ret); @@ -4301,28 +4343,24 @@ static int reconnect_caps_cb(struct inode *inode, int mds, void *arg) struct ceph_inode_info *ci = ceph_inode(inode); struct ceph_reconnect_state *recon_state = arg; struct ceph_pagelist *pagelist = recon_state->pagelist; struct dentry *dentry; struct ceph_cap *cap; - char *path; - int pathlen = 0, err; - u64 pathbase; + struct ceph_path_info path_info = {0}; + int err; u64 snap_follows; dentry = d_find_primary(inode); if (dentry) { /* set pathbase to parent dir when msg_version >= 2 */ - path = ceph_mdsc_build_path(mdsc, dentry, &pathlen, &pathbase, + char *path = ceph_mdsc_build_path(mdsc, dentry, &path_info, recon_state->msg_version >= 2); dput(dentry); if (IS_ERR(path)) { err = PTR_ERR(path); goto out_err; } - } else { - path = NULL; - pathbase = 0; } spin_lock(&ci->i_ceph_lock); cap = __get_cap_for_mds(ci, mds); if (!cap) { @@ -4351,22 +4389,22 @@ static int reconnect_caps_cb(struct inode *inode, int mds, void *arg) if (recon_state->msg_version >= 2) { rec.v2.cap_id = cpu_to_le64(cap->cap_id); rec.v2.wanted = cpu_to_le32(__ceph_caps_wanted(ci)); rec.v2.issued = cpu_to_le32(cap->issued); rec.v2.snaprealm = cpu_to_le64(ci->i_snap_realm->ino); - rec.v2.pathbase = cpu_to_le64(pathbase); + rec.v2.pathbase = cpu_to_le64(path_info.vino.ino); rec.v2.flock_len = (__force __le32) ((ci->i_ceph_flags & CEPH_I_ERROR_FILELOCK) ? 0 : 1); } else { rec.v1.cap_id = cpu_to_le64(cap->cap_id); rec.v1.wanted = cpu_to_le32(__ceph_caps_wanted(ci)); rec.v1.issued = cpu_to_le32(cap->issued); rec.v1.size = cpu_to_le64(i_size_read(inode)); ceph_encode_timespec64(&rec.v1.mtime, &inode->i_mtime); ceph_encode_timespec64(&rec.v1.atime, &inode->i_atime); rec.v1.snaprealm = cpu_to_le64(ci->i_snap_realm->ino); - rec.v1.pathbase = cpu_to_le64(pathbase); + rec.v1.pathbase = cpu_to_le64(path_info.vino.ino); } if (list_empty(&ci->i_cap_snaps)) { snap_follows = ci->i_head_snapc ? ci->i_head_snapc->seq : 0; } else { @@ -4424,11 +4462,11 @@ static int reconnect_caps_cb(struct inode *inode, int mds, void *arg) struct_len = 2 * sizeof(u32) + (num_fcntl_locks + num_flock_locks) * sizeof(struct ceph_filelock); rec.v2.flock_len = cpu_to_le32(struct_len); - struct_len += sizeof(u32) + pathlen + sizeof(rec.v2); + struct_len += sizeof(u32) + path_info.pathlen + sizeof(rec.v2); if (struct_v >= 2) struct_len += sizeof(u64); /* snap_follows */ total_len += struct_len; @@ -4448,32 +4486,32 @@ static int reconnect_caps_cb(struct inode *inode, int mds, void *arg) if (recon_state->msg_version >= 3) { ceph_pagelist_encode_8(pagelist, struct_v); ceph_pagelist_encode_8(pagelist, 1); ceph_pagelist_encode_32(pagelist, struct_len); } - ceph_pagelist_encode_string(pagelist, path, pathlen); + ceph_pagelist_encode_string(pagelist, (char *)path_info.path, path_info.pathlen); ceph_pagelist_append(pagelist, &rec, sizeof(rec.v2)); ceph_locks_to_pagelist(flocks, pagelist, num_fcntl_locks, num_flock_locks); if (struct_v >= 2) ceph_pagelist_encode_64(pagelist, snap_follows); out_freeflocks: kfree(flocks); } else { err = ceph_pagelist_reserve(pagelist, sizeof(u64) + sizeof(u32) + - pathlen + sizeof(rec.v1)); + path_info.pathlen + sizeof(rec.v1)); if (err) goto out_err; ceph_pagelist_encode_64(pagelist, ceph_ino(inode)); - ceph_pagelist_encode_string(pagelist, path, pathlen); + ceph_pagelist_encode_string(pagelist, (char *)path_info.path, path_info.pathlen); ceph_pagelist_append(pagelist, &rec, sizeof(rec.v1)); } out_err: - ceph_mdsc_free_path(path, pathlen); + ceph_mdsc_free_path_info(&path_info); if (!err) recon_state->nr_caps++; return err; } diff --git a/fs/ceph/mds_client.h b/fs/ceph/mds_client.h index d930eb79dc38..66bc179413f3 100644 --- a/fs/ceph/mds_client.h +++ b/fs/ceph/mds_client.h @@ -573,18 +573,28 @@ extern void ceph_reclaim_caps_nr(struct ceph_mds_client *mdsc, int nr); extern int ceph_iterate_session_caps(struct ceph_mds_session *session, int (*cb)(struct inode *, int mds, void *), void *arg); extern void ceph_mdsc_pre_umount(struct ceph_mds_client *mdsc); -static inline void ceph_mdsc_free_path(char *path, int len) +/* + * Structure to group path-related output parameters for build_*_path functions + */ +struct ceph_path_info { + const char *path; + int pathlen; + struct ceph_vino vino; + bool freepath; +}; + +static inline void ceph_mdsc_free_path_info(const struct ceph_path_info *path_info) { - if (!IS_ERR_OR_NULL(path)) - __putname(path - (PATH_MAX - 1 - len)); + if (path_info && path_info->freepath && !IS_ERR_OR_NULL(path_info->path)) + __putname((char *)path_info->path - (PATH_MAX - 1 - path_info->pathlen)); } extern char *ceph_mdsc_build_path(struct ceph_mds_client *mdsc, - struct dentry *dentry, int *plen, u64 *base, + struct dentry *dentry, struct ceph_path_info *path_info, int for_wire); extern void __ceph_mdsc_drop_dentry_lease(struct dentry *dentry); extern void ceph_mdsc_lease_send_msg(struct ceph_mds_session *session, struct dentry *dentry, char action, -- 2.34.3

2 1

[PATCH OLK-6.6] smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path
by Wang Zhaolong 14 Jan '26

14 Jan '26

From: Stefan Metzmacher <metze(a)samba.org> stable inclusion from stable-v6.6.108 commit e7b7a93879558e77d950f1ff9a6f3daa385b33df category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/8210 CVE: CVE-2025-39929 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit daac51c7032036a0ca5f1aa419ad1b0471d1c6e0 ] During tests of another unrelated patch I was able to trigger this error: Objects remaining on __kmem_cache_shutdown() Cc: Steve French <smfrench(a)gmail.com> Cc: Tom Talpey <tom(a)talpey.com> Cc: Long Li <longli(a)microsoft.com> Cc: Namjae Jeon <linkinjeon(a)kernel.org> Cc: linux-cifs(a)vger.kernel.org Cc: samba-technical(a)lists.samba.org Fixes: f198186aa9bb ("CIFS: SMBD: Establish SMB Direct connection") Signed-off-by: Stefan Metzmacher <metze(a)samba.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Wang Zhaolong <wangzhaolong(a)huaweicloud.com> --- fs/smb/client/smbdirect.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/smb/client/smbdirect.c b/fs/smb/client/smbdirect.c index d74e829de51c..02a30b769066 100644 --- a/fs/smb/client/smbdirect.c +++ b/fs/smb/client/smbdirect.c @@ -1046,12 +1046,14 @@ static int smbd_negotiate(struct smbd_connection *info) response->type = SMBD_NEGOTIATE_RESP; rc = smbd_post_recv(info, response); log_rdma_event(INFO, "smbd_post_recv rc=%d iov.addr=0x%llx iov.length=%u iov.lkey=0x%x\n", rc, response->sge.addr, response->sge.length, response->sge.lkey); - if (rc) + if (rc) { + put_receive_buffer(info, response); return rc; + } init_completion(&info->negotiate_completion); info->negotiate_done = false; rc = smbd_post_send_negotiate_req(info); if (rc) -- 2.34.3

2 1