- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] binfmt_misc: reject a flag character as the field delimiter
by Luo Gengkun 21 Aug '26

21 Aug '26

From: Christian Brauner <brauner(a)kernel.org> stable inclusion from stable-v6.6.151 commit 1819f82dee766c58295ecaacdac02cdf6837d7a4 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17790 CVE: CVE-2026-74485 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- commit 8e85d50ba1117fd446bf9a250bd8a97d48384bdc upstream. The registration string starts with a user chosen delimiter that separates the individual fields. So that the field parsers terminate even on a truncated string create_entry() pads the buffer with that same delimiter: memset(buf + count, del, 8); Most fields are scanned for the delimiter with strchr()/scanarg() and happily stop on the padding. The flags field is different: instead of scanning for the delimiter check_special_flags() consumes the flag characters 'P', 'O', 'C' and 'F' and stops at the first byte that is none of them, relying on the trailing delimiter to end the scan. If the delimiter is itself a flag character the padding no longer acts as a terminator. The scan swallows all eight padding bytes and keeps reading past the end of the allocation until it hits a byte that is not a flag character. For example registering PaPEPPxPPiP with 'P' as the delimiter (name "a", type extension, magic "x", interpreter "i", empty flags) leaves the flag scan running off the end of the buffer. The registration is rejected in the end because the parser does not stop exactly at buf + count, but only after the out of bounds read has already happened. With an unlucky allocation layout the scan can walk into an unmapped page; under KASAN it is reported as a slab out of bounds read. binfmt_misc mounts are available to unprivileged users in a user namespace so the read is reachable without privileges. Reject a delimiter that is one of the flag characters up front. Such a registration was always rejected anyway, only after the out of bounds read, so no valid registration string changes meaning. Link: https://patch.msgid.link/20260710-work-binfmt_misc-locking-v3-3-a162f7cb58d… Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Signed-off-by: Christian Brauner (Amutable) <brauner(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- fs/binfmt_misc.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c index bf954bac70a9..5f6e354cb565 100644 --- a/fs/binfmt_misc.c +++ b/fs/binfmt_misc.c @@ -349,6 +349,10 @@ static Node *create_entry(const char __user *buffer, size_t count) pr_debug("register: delim: %#x {%c}\n", del, del); + /* A flag-char delimiter runs the flag scan off the buffer. */ + if (del == 'P' || del == 'O' || del == 'C' || del == 'F') + goto einval; + /* Pad the buffer with the delim to simplify parsing below. */ memset(buf + count, del, 8); -- 2.34.1

2 1

[PATCH OLK-6.6] nvmet-tcp: fix page fragment cache leak in error path
by Lai Zewei 21 Aug '26

21 Aug '26

mainline inclusion from mainline-v7.2-rc1 commit 4dae393956093c807212918fd91a8fc70df15338 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17264 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In nvmet_tcp_alloc_queue(), when a connection is closed during the allocation process (e.g., nvmet_tcp_set_queue_sock() returns -ENOTCONN), the error handling jumps to out_destroy_sq and then to out_ida_remove without draining the page fragment cache. Although nvmet_tcp_free_cmd() is called in some error paths to release individual page fragments, the underlying page cache reference held by queue->pf_cache is never released. The first allocation using pf_cache is the call to nvmet_tcp_alloc_cmd() for queue->connect, which happens after ida_alloc() returns successfully. This results in a page leak each time a connection fails during allocation, which could lead to memory exhaustion over time if connections are repeatedly opened and closed. Fix this by calling page_frag_cache_drain() before freeing the queue structure in the out_ida_remove label. Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver") Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Geliang Tang <tanggeliang(a)kylinos.cn> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Conflicts: drivers/nvme/target/tcp.c [ctx conflicts] Signed-off-by: Lai Zewei <laizewei3(a)huawei.com> --- drivers/nvme/target/tcp.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c index 6c6197a53fa3..fb6af1be694f 100644 --- a/drivers/nvme/target/tcp.c +++ b/drivers/nvme/target/tcp.c @@ -1754,6 +1754,14 @@ static int nvmet_tcp_alloc_queue(struct nvmet_tcp_port *port, nvmet_tcp_free_cmd(&queue->connect); out_ida_remove: ida_free(&nvmet_tcp_queue_ida, queue->idx); + /* + * Drain the page fragment cache if any allocations were done. + * The first allocation using pf_cache is nvmet_tcp_alloc_cmd() + * for queue->connect after ida_alloc(). + */ + if (queue->pf_cache.va) + __page_frag_cache_drain(virt_to_head_page(queue->pf_cache.va), + queue->pf_cache.pagecnt_bias); out_free_queue: kfree(queue); return ret; -- 2.52.0

2 1

[PATCH openEuler-1.0-LTS 0/2] *** SUBJECT HERE ***
by Lai Zewei 20 Aug '26

20 Aug '26

*** BLURB HERE *** Lai Zewei (2): nfsd: fix heap overflow in NFSv4.0 LOCK replay cache nfsd: use dynamic allocation for oversized NFSv4.0 replay cache fs/nfsd/nfs4state.c | 16 ++++++++++++++++ fs/nfsd/nfs4xdr.c | 18 ++++++++++++++++-- fs/nfsd/state.h | 21 +++++++++++++++------ 3 files changed, 47 insertions(+), 8 deletions(-) -- 2.52.0

2 3

[PATCH openEuler-1.0-LTS 0/2] *** SUBJECT HERE ***
by Lai Zewei 20 Aug '26

20 Aug '26

*** BLURB HERE *** Lai Zewei (2): nfsd: fix heap overflow in NFSv4.0 LOCK replay cache nfsd: use dynamic allocation for oversized NFSv4.0 replay cache fs/nfsd/nfs4state.c | 16 ++++++++++++++++ fs/nfsd/nfs4xdr.c | 18 ++++++++++++++++-- fs/nfsd/state.h | 21 +++++++++++++++------ 3 files changed, 47 insertions(+), 8 deletions(-) -- 2.52.0

2 3

[PATCH OLK-6.6 0/4] *** SUBJECT HERE ***
by Lu Chentao 20 Aug '26

20 Aug '26

*** BLURB HERE *** Lu Chentao (4): [OLK-6.6] cifs: prevent readdir from changing file size due to stale directory metadata [OLK-6.6] cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths [OLK-6.6] cifs: consolidate time_last_write stamp into _cifsFileInfo_put() [OLK-6.6] cifs: fix time_last_write stamp placement in setattr/truncate paths fs/smb/client/cifsfs.c | 1 + fs/smb/client/cifsglob.h | 1 + fs/smb/client/file.c | 65 ++++++++++++++++++++++++++++++++++++---- fs/smb/client/inode.c | 25 +++++++++++++++- fs/smb/client/misc.c | 27 +++++++++++++---- 5 files changed, 106 insertions(+), 13 deletions(-) -- 2.52.0

2 5

[PATCH OLK-6.6 00/16] backport minios part3 patches from linux mainline
by Qinxin Xia 20 Aug '26

20 Aug '26

From: Hongye Lin <linhongye(a)h-partners.com> driver inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8904 ---------------------------------------------------------------------- backport minios part3 patches from linux mainline Andre Przywara (1): kselftest/arm64: hwcap: fix f8dp2 cpuinfo name Mark Brown (14): kselftest/arm64: Handle FPMR context in generic signal frame parser kselftest/arm64: Add basic FPMR test kselftest/arm64: Add 2023 DPISA hwcap test coverage arm64/sve: Report FEAT_SVE_B16B16 to userspace arm64/sysreg: Update ID_AA64FPFR0_EL1 to DDI0601 2024-09 arm64/sysreg: Update ID_AA64ZFR0_EL1 to DDI0601 2024-09 arm64/sysreg: Update ID_AA64ISAR2_EL1 to DDI0601 2024-09 arm64/sysreg: Update ID_AA64SMFR0_EL1 to DDI0601 2024-12 arm64/hwcap: Describe 2024 dpISA extensions to userspace arm64/hwcap: Remove stray references to SF8MMx arm64: Add missing registrations of hwcaps kselftest/arm64: Verify HWCAP2_SVE_B16B16 kselftest/arm64: Fix encoding for SVE B16B16 test kselftest/arm64: Add 2024 dpISA extensions to hwcap test Yifan Wu (1): selftests/arm64: Implement cmpbr_sigill() to hwcap test .../arch/arm64/cpu-feature-registers.rst | 2 + Documentation/arch/arm64/elf_hwcaps.rst | 53 +++ arch/arm64/include/asm/hwcap.h | 16 + arch/arm64/include/uapi/asm/hwcap.h | 17 + arch/arm64/kernel/cpufeature.c | 35 ++ arch/arm64/kernel/hwcap_str.h | 16 + arch/arm64/tools/sysreg | 62 ++- tools/testing/selftests/arm64/abi/hwcap.c | 449 ++++++++++++++++++ .../testing/selftests/arm64/signal/.gitignore | 1 + .../arm64/signal/testcases/fpmr_siginfo.c | 82 ++++ .../arm64/signal/testcases/testcases.c | 8 + .../arm64/signal/testcases/testcases.h | 1 + 12 files changed, 735 insertions(+), 7 deletions(-) create mode 100644 tools/testing/selftests/arm64/signal/testcases/fpmr_siginfo.c -- 2.33.0

2 17

[PATCH openEuler-1.0-LTS 0/2] *** SUBJECT HERE ***
by Lai Zewei 20 Aug '26

20 Aug '26

*** BLURB HERE *** Lai Zewei (2): nfsd: fix heap overflow in NFSv4.0 LOCK replay cache nfsd: use dynamic allocation for oversized NFSv4.0 replay cache fs/nfsd/nfs4state.c | 16 ++++++++++++++++ fs/nfsd/nfs4xdr.c | 18 ++++++++++++++++-- fs/nfsd/state.h | 21 +++++++++++++++------ 3 files changed, 47 insertions(+), 8 deletions(-) -- 2.52.0

2 3

[PATCH OLK-6.6] bpf: Mask pseudo pointer values in verifier logs
by Pu Lehui 20 Aug '26

20 Aug '26

From: Nuoqi Gui <gnq25(a)mails.tsinghua.edu.cn> mainline inclusion from mainline-v7.2-rc2 commit 72a85e9464a5332fb2cd7efd26d9295275ceda2d category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9793 CVE: CVE-2026-72402 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- print_bpf_insn() masks ldimm64 immediates for pointer-bearing pseudo sources when pointer leaks are not allowed, but the mask only covers BPF_PSEUDO_MAP_FD and BPF_PSEUDO_MAP_VALUE. BPF_PSEUDO_MAP_IDX, BPF_PSEUDO_MAP_IDX_VALUE, and BPF_PSEUDO_BTF_ID can also be resolved to kernel pointer values before the verifier log prints the instruction. Include them in the existing pointer classification so the log prints 0x0 instead of the rewritten address. Fixes: 4976b718c355 ("bpf: Introduce pseudo_btf_id") Fixes: 387544bfa291 ("bpf: Introduce fd_idx") Signed-off-by: Nuoqi Gui <gnq25(a)mails.tsinghua.edu.cn> Link: https://lore.kernel.org/r/20260623-f01-13-pseudo-btf-id-cap-bpf-v2-1-a190eb… Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Acked-by: Eduard Zingerman <eddyz87(a)gmail.com> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/disasm.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/kernel/bpf/disasm.c b/kernel/bpf/disasm.c index 49940c26a227..cc3c9792c4a6 100644 --- a/kernel/bpf/disasm.c +++ b/kernel/bpf/disasm.c @@ -287,7 +287,10 @@ void print_bpf_insn(const struct bpf_insn_cbs *cbs, */ u64 imm = ((u64)(insn + 1)->imm << 32) | (u32)insn->imm; bool is_ptr = insn->src_reg == BPF_PSEUDO_MAP_FD || - insn->src_reg == BPF_PSEUDO_MAP_VALUE; + insn->src_reg == BPF_PSEUDO_MAP_VALUE || + insn->src_reg == BPF_PSEUDO_MAP_IDX || + insn->src_reg == BPF_PSEUDO_MAP_IDX_VALUE || + insn->src_reg == BPF_PSEUDO_BTF_ID; char tmp[64]; if (is_ptr && !allow_ptr_leaks) -- 2.34.1

2 1

[PATCH OLK-6.6 0/4] *** SUBJECT HERE ***
by Lu Chentao 20 Aug '26

20 Aug '26

*** BLURB HERE *** Lu Chentao (4): [OLK-6.6] cifs: prevent readdir from changing file size due to stale directory metadata [OLK-6.6] cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths [OLK-6.6] cifs: consolidate time_last_write stamp into _cifsFileInfo_put() [OLK-6.6] cifs: fix time_last_write stamp placement in setattr/truncate paths fs/smb/client/cifsfs.c | 1 + fs/smb/client/cifsglob.h | 1 + fs/smb/client/file.c | 65 ++++++++++++++++++++++++++++++++++++---- fs/smb/client/inode.c | 25 +++++++++++++++- fs/smb/client/misc.c | 27 +++++++++++++---- 5 files changed, 106 insertions(+), 13 deletions(-) -- 2.52.0

2 5

[PATCH OLK-6.6 1/4] [OLK-6.6] cifs: prevent readdir from changing file size due to stale directory metadata
by Lu Chentao 20 Aug '26

20 Aug '26

mainline inclusion from mainline-v7.2-rc5 commit e8a8d54c2d508891c142a928fc7d298c4c8bd0dd category: bugfix bugzilla: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Windows Server's directory enumeration metadata lags behind the actual file size after a write+close or rename. A concurrent readdir() in the window between close() returning to userspace and stat() being called overwrites the correct cached i_size with the stale server value, causing stat() to return the wrong size. Once _cifsFileInfo_put() removes the last writable handle from openFileList, is_size_safe_to_change() permits readdir to overwrite i_size. smb2_close_getattr() then stamps cifs_i->time = jiffies, making the corrupt cached value appear fresh to the next stat(). The existing check (see Fixes:) only blocked stale size updates while an active RW lease was held, not after the last writable handle closes. Add cifsInodeInfo->time_last_write, written via smp_store_release() at writable close and on setattr/truncate. is_size_safe_to_change() checks is_inode_writable() first (acquiring open_file_lock), then rejects a readdir size update if time_last_write falls within acregmax jiffies. The spinlock release in _cifsFileInfo_put() forms a store-release barrier that pairs with the spin_lock() (load-acquire) in is_inode_writable(), ensuring the subsequent smp_load_acquire() on time_last_write observes any update from a concurrent close(). When a size update is rejected and the server value differs from the cached one, cifs_i->time is cleared to force a fresh QUERY_INFO on the next stat(). readdir is also blocked from changing i_size while writable handles are open or an RW lease is held, even on direct-IO mounts. For deferred close (closetimeo > 0), time_last_write is refreshed at the actual server close in smb2_deferred_work_close() and in the cifs_close_deferred_file*() drain paths invoked by lease/oplock breaks and tcon teardown, anchoring the protection window to the real close time rather than the earlier userspace close. time_last_write == 0 skips the time_before() check to avoid false positives near boot on 32-bit systems where jiffies starts close to INITIAL_JIFFIES. Does not reproduce against Samba or with actimeo=0. Fixes: e4b61f3b1c67 ("cifs: prevent updating file size from server if we have a read/write lease") Signed-off-by: Frank Sorenson <sorenson(a)redhat.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/client/cifsfs.c fs/smb/client/cifsglob.h fs/smb/client/file.c fs/smb/client/inode.c fs/smb/client/misc.c [Conflicts due to context] Signed-off-by: Lu Chentao <luchentao1(a)huawei.com> --- fs/smb/client/cifsfs.c | 1 + fs/smb/client/cifsglob.h | 1 + fs/smb/client/file.c | 70 ++++++++++++++++++++++++++++++++++++---- fs/smb/client/inode.c | 7 +++- fs/smb/client/misc.c | 27 ++++++++++++++-- 5 files changed, 96 insertions(+), 10 deletions(-) diff --git a/fs/smb/client/cifsfs.c b/fs/smb/client/cifsfs.c index a2887b978dc8..35863213b46c 100644 --- a/fs/smb/client/cifsfs.c +++ b/fs/smb/client/cifsfs.c @@ -399,10 +399,11 @@ cifs_alloc_inode(struct super_block *sb) cifs_inode = alloc_inode_sb(sb, cifs_inode_cachep, GFP_KERNEL); if (!cifs_inode) return NULL; cifs_inode->cifsAttrs = 0x20; /* default */ cifs_inode->time = 0; + cifs_inode->time_last_write = 0; /* * Until the file is open and we have gotten oplock info back from the * server, can not assume caching of file data or metadata. */ cifs_set_oplock_level(cifs_inode, 0); diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h index fdafc6f1eb4f..cd1a60f63cbc 100644 --- a/fs/smb/client/cifsglob.h +++ b/fs/smb/client/cifsglob.h @@ -1599,10 +1599,11 @@ struct cifsInodeInfo { #define CIFS_INO_CLOSE_ON_LOCK (7) /* Not to defer the close when lock is set */ unsigned long flags; spinlock_t writers_lock; unsigned int writers; /* Number of writers on this inode */ unsigned long time; /* jiffies of last update of inode */ + unsigned long time_last_write; /* jiffies of last writable close or truncate */ u64 server_eof; /* current file size on server -- protected by i_lock */ u64 uniqueid; /* server inode number */ u64 createtime; /* creation time on server */ __u8 lease_key[SMB2_LEASE_KEY_SIZE]; /* lease key for this inode */ struct list_head deferred_closes; /* list of deferred closes */ diff --git a/fs/smb/client/file.c b/fs/smb/client/file.c index 5eeadf94c279..b3f4c0584e02 100644 --- a/fs/smb/client/file.c +++ b/fs/smb/client/file.c @@ -1217,15 +1217,25 @@ cifs_reopen_file(struct cifsFileInfo *cfile, bool can_flush) void smb2_deferred_work_close(struct work_struct *work) { struct cifsFileInfo *cfile = container_of(work, struct cifsFileInfo, deferred.work); + struct cifsInodeInfo *cinode = CIFS_I(d_inode(cfile->dentry)); - spin_lock(&CIFS_I(d_inode(cfile->dentry))->deferred_lock); + spin_lock(&cinode->deferred_lock); cifs_del_deferred_close(cfile); cfile->deferred_close_scheduled = false; - spin_unlock(&CIFS_I(d_inode(cfile->dentry))->deferred_lock); + spin_unlock(&cinode->deferred_lock); + /* + * Refresh time_last_write immediately before the actual server close + * so the protection window is anchored to the real close time, not + * the earlier userspace close time stored by cifs_close(). + */ + if (OPEN_FMODE(cfile->f_flags) & FMODE_WRITE) { + /* Pairs with smp_load_acquire() in is_size_safe_to_change(). */ + smp_store_release(&cinode->time_last_write, jiffies); + } _cifsFileInfo_put(cfile, true, false); } static bool smb2_can_defer_close(struct inode *inode, struct cifs_deferred_close *dclose) @@ -1250,10 +1260,14 @@ int cifs_close(struct inode *inode, struct file *file) cifs_fscache_unuse_inode_cookie(inode, file->f_mode & FMODE_WRITE); if (file->private_data != NULL) { cfile = file->private_data; file->private_data = NULL; + if (file->f_mode & FMODE_WRITE) { + /* Pairs with smp_load_acquire() in is_size_safe_to_change(). */ + smp_store_release(&cinode->time_last_write, jiffies); + } dclose = kmalloc(sizeof(struct cifs_deferred_close), GFP_KERNEL); if ((cfile->status_file_deleted == false) && (smb2_can_defer_close(inode, dclose))) { if (test_and_clear_bit(CIFS_INO_MODIFIED_ATTR, &cinode->flags)) { inode_set_mtime_to_ts(inode, @@ -5004,31 +5018,75 @@ static int is_inode_writable(struct cifsInodeInfo *cifs_inode) but this is tricky to do without racing with writebehind page caching in the current Linux kernel design */ bool is_size_safe_to_change(struct cifsInodeInfo *cifsInode, __u64 end_of_file, bool from_readdir) { + struct cifs_sb_info *cifs_sb; + unsigned long tlw; + if (!cifsInode) return true; + cifs_sb = CIFS_SB(cifsInode->netfs.inode.i_sb); + if (is_inode_writable(cifsInode) || ((cifsInode->oplock & CIFS_CACHE_RW_FLG) != 0 && from_readdir)) { /* This inode is open for write at least once */ - struct cifs_sb_info *cifs_sb; - cifs_sb = CIFS_SB(cifsInode->netfs.inode.i_sb); + /* + * Readdir data is unreliable when we have writable handles or + * an exclusive lease -- never allow it to change i_size, even + * on direct-IO mounts where the server's directory metadata + * can still lag behind the actual file state. + */ + if (from_readdir) + return false; + if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_DIRECT_IO) { /* since no page cache to corrupt on directio we can change size safely */ return true; } if (i_size_read(&cifsInode->netfs.inode) < end_of_file) return true; return false; - } else - return true; + } + + /* + * No writable handles open. Check whether we are within the attribute + * cache validity window of a recent local modification. + * + * For the close() path: cifs_close() calls smp_store_release() on + * time_last_write before _cifsFileInfo_put() removes the handle under + * open_file_lock. That spin_unlock() is a store-release that pairs + * with the spin_lock() (load-acquire) in is_inode_writable() above, + * so if is_inode_writable() returned false the smp_load_acquire() + * below is guaranteed to observe any time_last_write update from a + * concurrent close(). + * + * For the setattr/truncate paths: those callers use smp_store_release() + * directly; the smp_load_acquire() below pairs with that store. There + * is no shared lock between setattr and readdir, so this relies on + * acquire-release semantics alone. The store propagation latency on + * weakly-ordered architectures (nanoseconds) is negligible relative to + * the acregmax window (seconds) and the readdir RPC round-trip + * (milliseconds), making this a sound design choice in practice. + * + * time_last_write == 0 means the inode has never been written locally; + * skip the window check to avoid false positives near boot time when + * jiffies is still close to INITIAL_JIFFIES on 32-bit systems. + */ + if (from_readdir) { + /* Pairs with smp_store_release() at close and truncate sites. */ + tlw = smp_load_acquire(&cifsInode->time_last_write); + if (tlw && time_before(jiffies, tlw + cifs_sb->ctx->acregmax)) + return false; + } + + return true; } static int cifs_write_begin(struct file *file, struct address_space *mapping, loff_t pos, unsigned len, struct page **pagep, void **fsdata) diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c index f5b50cb65360..94b8ceff3c60 100644 --- a/fs/smb/client/inode.c +++ b/fs/smb/client/inode.c @@ -225,10 +225,12 @@ cifs_fattr_to_inode(struct inode *inode, struct cifs_fattr *fattr, * i_blocks is not related to (i_size / i_blksize), * but instead 512 byte (2**9) size is required for * calculating num blocks. */ inode->i_blocks = (512 - 1 + fattr->cf_bytes) >> 9; + } else if (from_readdir && i_size_read(inode) != fattr->cf_eof) { + cifs_i->time = 0; } if (S_ISLNK(fattr->cf_mode) && fattr->cf_symlink_target) { kfree(cifs_i->symlink_target); cifs_i->symlink_target = fattr->cf_symlink_target; @@ -324,11 +326,10 @@ cifs_unix_basic_to_fattr(struct cifs_fattr *fattr, FILE_UNIX_BASIC_INFO *info, kuid_t uid = make_kuid(&init_user_ns, id); if (uid_valid(uid)) fattr->cf_uid = uid; } } - fattr->cf_gid = cifs_sb->ctx->linux_gid; if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_OVERR_GID)) { u64 id = le64_to_cpu(info->Gid); if (id < ((gid_t)-1)) { kgid_t gid = make_kgid(&init_user_ns, id); @@ -3129,10 +3130,12 @@ cifs_setattr_unix(struct dentry *direntry, struct iattr *attrs) if (rc) goto out; if ((attrs->ia_valid & ATTR_SIZE) && attrs->ia_size != i_size_read(inode)) { + /* Pairs with smp_load_acquire() in is_size_safe_to_change(). */ + smp_store_release(&cifsInode->time_last_write, jiffies); truncate_setsize(inode, attrs->ia_size); fscache_resize_cookie(cifs_inode_cookie(inode), attrs->ia_size); } setattr_copy(&nop_mnt_idmap, inode, attrs); @@ -3330,10 +3333,12 @@ cifs_setattr_nounix(struct dentry *direntry, struct iattr *attrs) if (rc) goto cifs_setattr_exit; if ((attrs->ia_valid & ATTR_SIZE) && attrs->ia_size != i_size_read(inode)) { + /* Pairs with smp_load_acquire() in is_size_safe_to_change(). */ + smp_store_release(&cifsInode->time_last_write, jiffies); truncate_setsize(inode, attrs->ia_size); fscache_resize_cookie(cifs_inode_cookie(inode), attrs->ia_size); } setattr_copy(&nop_mnt_idmap, inode, attrs); diff --git a/fs/smb/client/misc.c b/fs/smb/client/misc.c index 8bfb04e36ad7..cee96842d653 100644 --- a/fs/smb/client/misc.c +++ b/fs/smb/client/misc.c @@ -798,11 +798,18 @@ cifs_close_deferred_file(struct cifsInodeInfo *cifs_inode) } } spin_unlock(&cifs_inode->open_file_lock); list_for_each_entry_safe(tmp_list, tmp_next_list, &file_head, list) { - _cifsFileInfo_put(tmp_list->cfile, false, false); + struct cifsFileInfo *cfile = tmp_list->cfile; + + if (OPEN_FMODE(cfile->f_flags) & FMODE_WRITE) { + /* Pairs with smp_load_acquire() in is_size_safe_to_change(). */ + smp_store_release(&CIFS_I(d_inode(cfile->dentry))->time_last_write, + jiffies); + } + _cifsFileInfo_put(cfile, false, false); list_del(&tmp_list->list); kfree(tmp_list); } } @@ -831,11 +838,18 @@ cifs_close_all_deferred_files(struct cifs_tcon *tcon) } } spin_unlock(&tcon->open_file_lock); list_for_each_entry_safe(tmp_list, tmp_next_list, &file_head, list) { - _cifsFileInfo_put(tmp_list->cfile, true, false); + struct cifsFileInfo *cfile = tmp_list->cfile; + + if (OPEN_FMODE(cfile->f_flags) & FMODE_WRITE) { + /* Pairs with smp_load_acquire() in is_size_safe_to_change(). */ + smp_store_release(&CIFS_I(d_inode(cfile->dentry))->time_last_write, + jiffies); + } + _cifsFileInfo_put(cfile, true, false); list_del(&tmp_list->list); kfree(tmp_list); } } @@ -907,11 +921,18 @@ cifs_close_deferred_file_under_dentry(struct cifs_tcon *tcon, const char *path) } } spin_unlock(&tcon->open_file_lock); list_for_each_entry_safe(tmp_list, tmp_next_list, &file_head, list) { - _cifsFileInfo_put(tmp_list->cfile, true, false); + struct cifsFileInfo *cfile = tmp_list->cfile; + + if (OPEN_FMODE(cfile->f_flags) & FMODE_WRITE) { + /* Pairs with smp_load_acquire() in is_size_safe_to_change(). */ + smp_store_release(&CIFS_I(d_inode(cfile->dentry))->time_last_write, + jiffies); + } + _cifsFileInfo_put(cfile, true, false); list_del(&tmp_list->list); kfree(tmp_list); } free_dentry_path(page); } -- 2.52.0

2 4