From: Mikulas Patocka mpatocka@redhat.com

stable inclusion from stable-v5.4.274 commit e7d4cff57c3c43fdd72342c78d4138f509c7416e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9CC CVE: CVE-2024-35805

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=...

--------------------------------

[ Upstream commit 6e7132ed3c07bd8a6ce3db4bb307ef2852b322dc ]

There was reported lockup when we exit a snapshot with many exceptions. Fix this by adding "cond_resched" to the loop that frees the exceptions.

Reported-by: John Pittman jpittman@redhat.com Cc: stable@vger.kernel.org Signed-off-by: Mikulas Patocka mpatocka@redhat.com Signed-off-by: Mike Snitzer snitzer@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org

Conflicts: drivers/md/dm-snap.c [Commit f79ae415b64c change the way to traverse exception] Signed-off-by: Li Lingfeng lilingfeng3@huawei.com --- drivers/md/dm-snap.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c index 52101e5c7258..ad65b4a8464d 100644 --- a/drivers/md/dm-snap.c +++ b/drivers/md/dm-snap.c @@ -650,8 +650,10 @@ static void dm_exception_table_exit(struct dm_exception_table *et, for (i = 0; i < size; i++) { slot = et->table + i;

- list_for_each_entry_safe (ex, next, slot, hash_list) + list_for_each_entry_safe (ex, next, slot, hash_list) { kmem_cache_free(mem, ex); + cond_resched(); + } }

vfree(et->table);