From: Benjamin Coddington <bcodding@redhat.com> mainline inclusion from mainline-v6.16-rc5 commit c01776287414ca43412d1319d2877cbad65444ac category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/9400 CVE: CVE-2025-38393 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... -------------------------------- We found a few different systems hung up in writeback waiting on the same page lock, and one task waiting on the NFS_LAYOUT_DRAIN bit in pnfs_update_layout(), however the pnfs_layout_hdr's plh_outstanding count was zero. It seems most likely that this is another race between the waiter and waker similar to commit ed0172af5d6f ("SUNRPC: Fix a race to wake a sync task"). Fix it up by applying the advised barrier. Fixes: 880265c77ac4 ("pNFS: Avoid a live lock condition in pnfs_update_layout()") Signed-off-by: Benjamin Coddington <bcodding@redhat.com> Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com> Signed-off-by: Wang Zhaolong <wangzhaolong@huaweicloud.com> --- fs/nfs/pnfs.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c index 91998a68b360..4868b48cb299 100644 --- a/fs/nfs/pnfs.c +++ b/fs/nfs/pnfs.c @@ -1920,12 +1920,14 @@ static void nfs_layoutget_begin(struct pnfs_layout_hdr *lo) } static void nfs_layoutget_end(struct pnfs_layout_hdr *lo) { if (atomic_dec_and_test(&lo->plh_outstanding) && - test_and_clear_bit(NFS_LAYOUT_DRAIN, &lo->plh_flags)) + test_and_clear_bit(NFS_LAYOUT_DRAIN, &lo->plh_flags)) { + smp_mb__after_atomic(); wake_up_bit(&lo->plh_flags, NFS_LAYOUT_DRAIN); + } } static bool pnfs_is_first_layoutget(struct pnfs_layout_hdr *lo) { return test_bit(NFS_LAYOUT_FIRST_LAYOUTGET, &lo->plh_flags); -- 2.34.3