June 2024 - Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect()
by Kaixiong Yu 15 Jun '24

15 Jun '24

From: Dan Carpenter <dan.carpenter(a)oracle.com> stable inclusion from stable-v4.19.219 commit bca19bb2dc2d89ce60c4a4a6e59609d4cf2e13ef category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9S27V CVE: CVE-2021-47571 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit b535917c51acc97fb0761b1edec85f1f3d02bda4 upstream. The free_rtllib() function frees the "dev" pointer so there is use after free on the next line. Re-arrange things to avoid that. Fixes: 66898177e7e5 ("staging: rtl8192e: Fix unload/reload problem") Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> Link: https://lore.kernel.org/r/20211117072016.GA5237@kili Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- drivers/staging/rtl8192e/rtl8192e/rtl_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c index 7cdced0b0581..da73998bc5f7 100644 --- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c +++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c @@ -2579,13 +2579,14 @@ static void _rtl92e_pci_disconnect(struct pci_dev *pdev) free_irq(dev->irq, dev); priv->irq = 0; } - free_rtllib(dev); if (dev->mem_start != 0) { iounmap((void __iomem *)dev->mem_start); release_mem_region(pci_resource_start(pdev, 1), pci_resource_len(pdev, 1)); } + + free_rtllib(dev); } else { priv = rtllib_priv(dev); } -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 745a3c567e1c329d131a8896642475f3916d020a
by kernel test robot 15 Jun '24

15 Jun '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 745a3c567e1c329d131a8896642475f3916d020a !9017 misc/libmasm/module: Fix two use after free in ibmasm_init_one Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202406150959.idZDT1QZ-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202406151050.cbAafgsa-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) drivers/edac/skx_common.o: warning: objtool: missing symbol for section .text drivers/spi/spi-phytium-plat.c:186:34: warning: unused variable 'phytium_spi_of_match' [-Wunused-const-variable] kernel/livepatch/core.c:75:16: warning: no previous prototype for function 'klp_check_patch_kprobed' [-Wmissing-prototypes] mm/debug.c:143:21: warning: more '%' conversions than data arguments [-Wformat-insufficient-args] mm/debug.c:174:3: warning: format specifies type 'void *' but the argument has type 'int' [-Wformat] mm/debug.c:175:18: warning: format specifies type 'unsigned long' but the argument has type 'const unsigned long *' [-Wformat] mm/debug.c:175:3: warning: format specifies type 'int' but the argument has type 'unsigned long' [-Wformat] Unverified Error/Warning (likely false positive, please contact us if interested): drivers/block/loop.c:1338 loop_set_status() warn: inconsistent returns '&loop_ctl_mutex'. Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- x86_64-buildonly-randconfig-001-20240615 | |-- drivers-edac-skx_common.o:warning:objtool:missing-symbol-for-section-.text | `-- fs-f2fs-recovery.o:warning:objtool:missing-symbol-for-section-.init.text `-- x86_64-buildonly-randconfig-005-20240615 `-- fs-f2fs-.tmp_recovery.o:warning:objtool:missing-symbol-for-section-.init.text clang_recent_errors |-- x86_64-allyesconfig | `-- fs-f2fs-.tmp_recovery.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-002-20240615 | `-- fs-f2fs-recovery.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-006-20240615 | `-- fs-f2fs-recovery.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-randconfig-005-20240420 | |-- drivers-spi-spi-phytium-plat.c:warning:unused-variable-phytium_spi_of_match | |-- mm-debug.c:warning:format-specifies-type-int-but-the-argument-has-type-unsigned-long | |-- mm-debug.c:warning:format-specifies-type-unsigned-long-but-the-argument-has-type-const-unsigned-long | |-- mm-debug.c:warning:format-specifies-type-void-but-the-argument-has-type-int | `-- mm-debug.c:warning:more-conversions-than-data-arguments |-- x86_64-randconfig-073-20240521 | `-- kernel-livepatch-core.c:warning:no-previous-prototype-for-function-klp_check_patch_kprobed |-- x86_64-randconfig-103-20240609 | `-- drivers-acpi-cppc_acpi.c:WARNING:NULL-check-before-some-freeing-functions-is-not-needed. `-- x86_64-randconfig-161-20240430 `-- drivers-block-loop.c-loop_set_status()-warn:inconsistent-returns-loop_ctl_mutex-. elapsed time: 1596m configs tested: 35 configs skipped: 150 tested configs: arm64 allmodconfig gcc-13.2.0 arm64 allnoconfig gcc-13.2.0 arm64 defconfig gcc-13.2.0 arm64 randconfig-001-20240614 gcc-13.2.0 arm64 randconfig-002-20240614 gcc-13.2.0 arm64 randconfig-003-20240614 gcc-13.2.0 arm64 randconfig-004-20240614 gcc-13.2.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240615 gcc-9 x86_64 buildonly-randconfig-002-20240615 clang-18 x86_64 buildonly-randconfig-003-20240615 clang-18 x86_64 buildonly-randconfig-004-20240615 clang-18 x86_64 buildonly-randconfig-005-20240615 gcc-9 x86_64 buildonly-randconfig-006-20240615 clang-18 x86_64 defconfig gcc-13 x86_64 randconfig-001-20240615 gcc-13 x86_64 randconfig-002-20240615 gcc-8 x86_64 randconfig-003-20240615 gcc-13 x86_64 randconfig-004-20240615 gcc-13 x86_64 randconfig-005-20240615 gcc-13 x86_64 randconfig-006-20240615 gcc-8 x86_64 randconfig-011-20240615 clang-18 x86_64 randconfig-012-20240615 gcc-13 x86_64 randconfig-013-20240615 clang-18 x86_64 randconfig-014-20240615 clang-18 x86_64 randconfig-015-20240615 clang-18 x86_64 randconfig-016-20240615 clang-18 x86_64 randconfig-071-20240615 clang-18 x86_64 randconfig-072-20240615 clang-18 x86_64 randconfig-073-20240615 gcc-7 x86_64 randconfig-074-20240615 gcc-13 x86_64 randconfig-075-20240615 clang-18 x86_64 randconfig-076-20240615 gcc-13 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect()
by Kaixiong Yu 15 Jun '24

15 Jun '24

From: Dan Carpenter <dan.carpenter(a)oracle.com> stable inclusion from stable-v4.19.219 commit bca19bb2dc2d89ce60c4a4a6e59609d4cf2e13ef category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9S27V CVE: CVE-2021-47571 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit b535917c51acc97fb0761b1edec85f1f3d02bda4 upstream. The free_rtllib() function frees the "dev" pointer so there is use after free on the next line. Re-arrange things to avoid that. Fixes: 66898177e7e5 ("staging: rtl8192e: Fix unload/reload problem") Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> Link: https://lore.kernel.org/r/20211117072016.GA5237@kili Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- drivers/staging/rtl8192e/rtl8192e/rtl_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c index 7cdced0b0581..da73998bc5f7 100644 --- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c +++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c @@ -2579,13 +2579,14 @@ static void _rtl92e_pci_disconnect(struct pci_dev *pdev) free_irq(dev->irq, dev); priv->irq = 0; } - free_rtllib(dev); if (dev->mem_start != 0) { iounmap((void __iomem *)dev->mem_start); release_mem_region(pci_resource_start(pdev, 1), pci_resource_len(pdev, 1)); } + + free_rtllib(dev); } else { priv = rtllib_priv(dev); } -- 2.25.1

2 1

[PATCH OLK-6.6] openeuler_defconfig: fix checkdefconfig fail
by Peng Zhang 15 Jun '24

15 Jun '24

From: ZhangPeng <zhangpeng362(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IA5OHG ------------------------------------------------------- CONFIG_MODULE_ALLOW_BTF_MISMATCH=n The configs listed above are introduced but the openeuler_defconfig for aarch64 is not updated. Make update_oedefconfig to fix checkdefconfig fail. Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 4 ++++ arch/x86/configs/openeuler_defconfig | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index ab1db78f049a..41a1ea231ed0 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -7911,6 +7911,10 @@ CONFIG_DEBUG_INFO_COMPRESSED_NONE=y # CONFIG_DEBUG_INFO_COMPRESSED_ZLIB is not set # CONFIG_DEBUG_INFO_SPLIT is not set CONFIG_DEBUG_INFO_BTF=y +CONFIG_PAHOLE_HAS_SPLIT_BTF=y +CONFIG_PAHOLE_HAS_LANG_EXCLUDE=y +CONFIG_DEBUG_INFO_BTF_MODULES=y +# CONFIG_MODULE_ALLOW_BTF_MISMATCH is not set # CONFIG_GDB_SCRIPTS is not set CONFIG_FRAME_WARN=2048 CONFIG_STRIP_ASM_SYMS=y diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 0c6fc6018c2c..4a979fcc1790 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -9043,6 +9043,10 @@ CONFIG_DEBUG_INFO_COMPRESSED_NONE=y # CONFIG_DEBUG_INFO_COMPRESSED_ZLIB is not set # CONFIG_DEBUG_INFO_SPLIT is not set CONFIG_DEBUG_INFO_BTF=y +CONFIG_PAHOLE_HAS_SPLIT_BTF=y +CONFIG_PAHOLE_HAS_LANG_EXCLUDE=y +CONFIG_DEBUG_INFO_BTF_MODULES=y +# CONFIG_MODULE_ALLOW_BTF_MISMATCH is not set # CONFIG_GDB_SCRIPTS is not set CONFIG_FRAME_WARN=2048 CONFIG_STRIP_ASM_SYMS=y -- 2.25.1

2 1

[PATCH OLK-6.6] openeuler_defconfig: fix checkdefconfig fail
by Peng Zhang 15 Jun '24

15 Jun '24

From: ZhangPeng <zhangpeng362(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IA5OHG ------------------------------------------------------- CONFIG_MODULE_ALLOW_BTF_MISMATCH=n The configs listed above are introduced but the openeuler_defconfig for aarch64 is not updated. Make update_oedefconfig to fix checkdefconfig fail. Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 4 ++++ arch/x86/configs/openeuler_defconfig | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index ab1db78f049a..41a1ea231ed0 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -7911,6 +7911,10 @@ CONFIG_DEBUG_INFO_COMPRESSED_NONE=y # CONFIG_DEBUG_INFO_COMPRESSED_ZLIB is not set # CONFIG_DEBUG_INFO_SPLIT is not set CONFIG_DEBUG_INFO_BTF=y +CONFIG_PAHOLE_HAS_SPLIT_BTF=y +CONFIG_PAHOLE_HAS_LANG_EXCLUDE=y +CONFIG_DEBUG_INFO_BTF_MODULES=y +# CONFIG_MODULE_ALLOW_BTF_MISMATCH is not set # CONFIG_GDB_SCRIPTS is not set CONFIG_FRAME_WARN=2048 CONFIG_STRIP_ASM_SYMS=y diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 0c6fc6018c2c..4a979fcc1790 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -9043,6 +9043,10 @@ CONFIG_DEBUG_INFO_COMPRESSED_NONE=y # CONFIG_DEBUG_INFO_COMPRESSED_ZLIB is not set # CONFIG_DEBUG_INFO_SPLIT is not set CONFIG_DEBUG_INFO_BTF=y +CONFIG_PAHOLE_HAS_SPLIT_BTF=y +CONFIG_PAHOLE_HAS_LANG_EXCLUDE=y +CONFIG_DEBUG_INFO_BTF_MODULES=y +# CONFIG_MODULE_ALLOW_BTF_MISMATCH is not set # CONFIG_GDB_SCRIPTS is not set CONFIG_FRAME_WARN=2048 CONFIG_STRIP_ASM_SYMS=y -- 2.25.1

2 1

[OLK-6.6] openeuler_defconfig: fix checkdefconfig fail
by Peng Zhang 15 Jun '24

15 Jun '24

From: ZhangPeng <zhangpeng362(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IA5OHG ------------------------------------------------------- CONFIG_MODULE_ALLOW_BTF_MISMATCH=n The configs listed above are introduced but the openeuler_defconfig for aarch64 is not updated. Make update_oedefconfig to fix checkdefconfig fail. Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 4 ++++ arch/x86/configs/openeuler_defconfig | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index ab1db78f049a..41a1ea231ed0 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -7911,6 +7911,10 @@ CONFIG_DEBUG_INFO_COMPRESSED_NONE=y # CONFIG_DEBUG_INFO_COMPRESSED_ZLIB is not set # CONFIG_DEBUG_INFO_SPLIT is not set CONFIG_DEBUG_INFO_BTF=y +CONFIG_PAHOLE_HAS_SPLIT_BTF=y +CONFIG_PAHOLE_HAS_LANG_EXCLUDE=y +CONFIG_DEBUG_INFO_BTF_MODULES=y +# CONFIG_MODULE_ALLOW_BTF_MISMATCH is not set # CONFIG_GDB_SCRIPTS is not set CONFIG_FRAME_WARN=2048 CONFIG_STRIP_ASM_SYMS=y diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 0c6fc6018c2c..4a979fcc1790 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -9043,6 +9043,10 @@ CONFIG_DEBUG_INFO_COMPRESSED_NONE=y # CONFIG_DEBUG_INFO_COMPRESSED_ZLIB is not set # CONFIG_DEBUG_INFO_SPLIT is not set CONFIG_DEBUG_INFO_BTF=y +CONFIG_PAHOLE_HAS_SPLIT_BTF=y +CONFIG_PAHOLE_HAS_LANG_EXCLUDE=y +CONFIG_DEBUG_INFO_BTF_MODULES=y +# CONFIG_MODULE_ALLOW_BTF_MISMATCH is not set # CONFIG_GDB_SCRIPTS is not set CONFIG_FRAME_WARN=2048 CONFIG_STRIP_ASM_SYMS=y -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 0/2] CVE-2024-36971
by Liu Jian 15 Jun '24

15 Jun '24

CVE-2024-36971 Eric Dumazet (1): net: fix __dst_negative_advice() race Liu Jian (1): net: fix kabi breakage in struct dst_ops include/net/dst_ops.h | 4 ++++ include/net/sock.h | 13 +++---------- net/ipv4/route.c | 22 ++++++++-------------- net/ipv6/route.c | 29 +++++++++++++++-------------- net/xfrm/xfrm_policy.c | 11 +++-------- 5 files changed, 33 insertions(+), 46 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] RDMA/cma: Fix rdma_resolve_route() memory leak
by Zhao Wenhui 15 Jun '24

15 Jun '24

From: Gerd Rausch <gerd.rausch(a)oracle.com> stable inclusion from stable-v4.19.198 commit 4893c938f2a140a74be91779e45e4a7fa111198f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4ER CVE: CVE-2021-47345 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 74f160ead74bfe5f2b38afb4fcf86189f9ff40c9 ] Fix a memory leak when "mda_resolve_route() is called more than once on the same "rdma_cm_id". This is possible if cma_query_handler() triggers the RDMA_CM_EVENT_ROUTE_ERROR flow which puts the state machine back and allows rdma_resolve_route() to be called again. Link: https://lore.kernel.org/r/f6662b7b-bdb7-2706-1e12-47c61d3474b6@oracle.com Signed-off-by: Gerd Rausch <gerd.rausch(a)oracle.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- drivers/infiniband/core/cma.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c index 20a5501b740a..127ebd481689 100644 --- a/drivers/infiniband/core/cma.c +++ b/drivers/infiniband/core/cma.c @@ -2547,7 +2547,8 @@ static int cma_resolve_ib_route(struct rdma_id_private *id_priv, int timeout_ms) cma_init_resolve_route_work(work, id_priv); - route->path_rec = kmalloc(sizeof *route->path_rec, GFP_KERNEL); + if (!route->path_rec) + route->path_rec = kmalloc(sizeof *route->path_rec, GFP_KERNEL); if (!route->path_rec) { ret = -ENOMEM; goto err1; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] RDMA/cma: Fix rdma_resolve_route() memory leak
by Zhao Wenhui 15 Jun '24

15 Jun '24

From: Gerd Rausch <gerd.rausch(a)oracle.com> stable inclusion from stable-v4.19.198 commit 4893c938f2a140a74be91779e45e4a7fa111198f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4ER CVE: CVE-2021-47345 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 74f160ead74bfe5f2b38afb4fcf86189f9ff40c9 ] Fix a memory leak when "mda_resolve_route() is called more than once on the same "rdma_cm_id". This is possible if cma_query_handler() triggers the RDMA_CM_EVENT_ROUTE_ERROR flow which puts the state machine back and allows rdma_resolve_route() to be called again. Link: https://lore.kernel.org/r/f6662b7b-bdb7-2706-1e12-47c61d3474b6@oracle.com Signed-off-by: Gerd Rausch <gerd.rausch(a)oracle.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- drivers/infiniband/core/cma.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c index 20a5501b740a..127ebd481689 100644 --- a/drivers/infiniband/core/cma.c +++ b/drivers/infiniband/core/cma.c @@ -2547,7 +2547,8 @@ static int cma_resolve_ib_route(struct rdma_id_private *id_priv, int timeout_ms) cma_init_resolve_route_work(work, id_priv); - route->path_rec = kmalloc(sizeof *route->path_rec, GFP_KERNEL); + if (!route->path_rec) + route->path_rec = kmalloc(sizeof *route->path_rec, GFP_KERNEL); if (!route->path_rec) { ret = -ENOMEM; goto err1; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] fs/9p: fix uninitialized values during inode evict
by Long Li 15 Jun '24

15 Jun '24

From: Eric Van Hensbergen <ericvh(a)kernel.org> mainline inclusion from mainline-v6.9-rc1 commit 6630036b7c228f57c7893ee0403e92c2db2cd21d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9U997 CVE: CVE-2024-36923 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If an iget fails due to not being able to retrieve information from the server then the inode structure is only partially initialized. When the inode gets evicted, references to uninitialized structures (like fscache cookies) were being made. This patch checks for a bad_inode before doing anything other than clearing the inode from the cache. Since the inode is bad, it shouldn't have any state associated with it that needs to be written back (and there really isn't a way to complete those anyways). Reported-by: syzbot+eb83fe1cce5833cd66a0(a)syzkaller.appspotmail.com Signed-off-by: Eric Van Hensbergen <ericvh(a)kernel.org> Conflicts: fs/9p/vfs_inode.c [v9fs_evict_inode() function has been changed] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/9p/vfs_inode.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c index 88ca5015f987..483d777a8617 100644 --- a/fs/9p/vfs_inode.c +++ b/fs/9p/vfs_inode.c @@ -376,15 +376,19 @@ void v9fs_evict_inode(struct inode *inode) { struct v9fs_inode *v9inode = V9FS_I(inode); - truncate_inode_pages_final(&inode->i_data); - clear_inode(inode); - filemap_fdatawrite(&inode->i_data); - - v9fs_cache_inode_put_cookie(inode); - /* clunk the fid stashed in writeback_fid */ - if (v9inode->writeback_fid) { - p9_client_clunk(v9inode->writeback_fid); - v9inode->writeback_fid = NULL; + if (!is_bad_inode(inode)) { + truncate_inode_pages_final(&inode->i_data); + clear_inode(inode); + filemap_fdatawrite(&inode->i_data); + + v9fs_cache_inode_put_cookie(inode); + /* clunk the fid stashed in writeback_fid */ + if (v9inode->writeback_fid) { + p9_client_clunk(v9inode->writeback_fid); + v9inode->writeback_fid = NULL; + } + } else { + clear_inode(inode); } } -- 2.39.2

2 1