Changes in symlink.c

5dfa01ef37a8b944773aef8dee747cd76dec4234 - Merge tag 'vfs-7.1-rc5.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Mon, 18 May 2026 16:30:31 +0200

Merge tag 'vfs-7.1-rc5.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfsPull vfs fixes from Christian Brauner: "This contains a fixes for the current development cycle. Note that AI related review sometimes delays fixes a bit because we find more fixes for the fixes. I might try and send smaller but more fixes PRs if this trend keeps up. - Fix various netfslib bugs - Fix an out-of-bounds write when listing idmappings - Fix the return values in jfs_mkdir() and orangefs_mkdir() - Fix a writeback writeback array overflow in fuse - Fix a forced iversion increment on lazytime timestamp updates - Reject a negative timeval component in kern_select() - Fix error return when vfs_mkdir() fails in the cachefiles code - Fix wrong error code returned for pidns ioctls"* tag 'vfs-7.1-rc5.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (31 commits) cachefiles: Fix error return when vfs_mkdir() fails afs: Fix the locking used by afs_get_link() netfs, afs: Fix write skipping in dir/link writepages netfs: Fix netfs_read_folio() to wait on writeback netfs: Fix folio->private handling in netfs_perform_write() netfs: Fix partial invalidation of streaming-write folio netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() netfs: Fix leak of request in netfs_write_begin() error handling netfs: Fix early put of sink folio in netfs_read_gaps() netfs: Fix write streaming disablement if fd open O_RDWR netfs: Fix read-gaps to remove netfs_folio from filled folio netfs: Fix potential deadlock in write-through mode netfs: Fix streaming write being overwritten netfs: Defer the emission of trace_netfs_folio() netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone netfs: Fix overrun check in netfs_extract_user_iter() netfs: fix error handling in netfs_extract_user_iter() netfs: Fix potential uninitialised var in netfs_extract_user_iter() netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call netfs: Fix zeropoint update where i_size > remote_i_size ... List of files: /linux/fs/afs/symlink.c

45205929a3a3310e4978f4097d8ed4fca36b2c32 - Merge patch series "netfs: Miscellaneous fixes"

Tue, 12 May 2026 14:42:38 +0200

Merge patch series "netfs: Miscellaneous fixes"David Howells says:Here are the outstanding miscellaneous fixes for netfslib gathered togetherand with some fixes-to-fixes folded down and one rearrangement. VariousSashiko review comments[1][2][3][4][5] are addressed: (1) Fix subrequest cancellation cleanup in DIO read and single-read. (2) Fix missing locking around retry adding new subrequests. (3) Fix read and write result collection to use barriering correctly to access a request's subrequest lists without taking a lock. This adds list_add_tail_release() and list_first_entry_or_null_acquire() to appropriate incorporate barriering into some list functions. (4) Fix netfs_read_to_pagecache() to pause on subrequest I/O failure. (5) Fix the potential for 64-bit tearing on a 32-bit machine when reading netfs_inode->remote_i_size and ->zero_point by using much the same mechanism as is used for ->i_size. (6) Fix the calculation of zero_point in netfs_release_folio() to limit it to ->remote_i_size, not ->i_size. (7) Fix triggering of a VM_BUG_ON_FOLIO() in netfs_write_begin(). (8) Fix a potentially uninitialised error value in netfs_extract_user_iter(). (9) Fix error handling in netfs_extract_user_iter().(10) Fix overrun checking in netfs_extract_user_iter().(11) Fix netfs_invalidate_folio() to clear the folio dirty bit if all dirty data removed.(12) Defer the emission of trace_netfs_folio() in netfs_perform_write(). This allows the next patch to emit the correct traces.(13) Fix the handling of a partially failed copy (ie. EFAULT) into a streaming write folio. Also remove the netfs_folio if a streaming write folio is entirely overwritten.(14) Fix a potential deadlock in writethrough writing.(15) Fix netfs_read_gaps() to remove the netfs_folio from a filled folio.(16) Fix netfs_perform_write() to not disable streaming writes when writing to an fd that's open O_RDWR.(17) Fix an early put of the sink page used in netfs_read_gaps(), before the request has completed.(18) Fix request leak in netfs_write_begin() error handling.(19) Fix a potential UAF in netfs_unlock_abandoned_read_pages() due to trying to check index of each folio we're abandoning to see if that folio is actually owned by the caller (in which case, we're not actually allowed to dereference it).(20) Fix incorrect adjustment of dirty region when partially invalidating a streaming write folio.(21) Fix the handling of folio->private in netfs_perform_write() and the attached netfs_folio and/or group when a streaming write folio is modified.(22) Fix netfs_read_folio() to wait on writeback first (it holds the folio lock) otherwise we aren't allowed to look at the netfs_folio struct as that could be modified at any time by the writeback collector.(23) Fix write skipping in dir/symlink writepages.(24) Fix the locking used by afs_get_link().[1] https://sashiko.dev/#/patchset/20260414082004.3756080-1-dhowells%40redhat.com[2] https://sashiko.dev/#/patchset/20260326104544.509518-1-dhowells%40redhat.com[3] https://sashiko.dev/#/patchset/20260425125426.3855807-1-dhowells%40redhat.com[4] https://sashiko.dev/#/patchset/20260427154639.180684-1-dhowells%40redhat.com[5] https://sashiko.dev/#/patchset/20260428131756.922303-1-dhowells%40redhat.com* patches from https://patch.msgid.link/20260512123404.719402-1-dhowells@redhat.com: (24 commits) afs: Fix the locking used by afs_get_link() netfs, afs: Fix write skipping in dir/link writepages netfs: Fix netfs_read_folio() to wait on writeback netfs: Fix folio->private handling in netfs_perform_write() netfs: Fix partial invalidation of streaming-write folio netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() netfs: Fix leak of request in netfs_write_begin() error handling netfs: Fix early put of sink folio in netfs_read_gaps() netfs: Fix write streaming disablement if fd open O_RDWR netfs: Fix read-gaps to remove netfs_folio from filled folio netfs: Fix potential deadlock in write-through mode netfs: Fix streaming write being overwritten netfs: Defer the emission of trace_netfs_folio() netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone netfs: Fix overrun check in netfs_extract_user_iter() netfs: fix error handling in netfs_extract_user_iter() netfs: Fix potential uninitialised var in netfs_extract_user_iter() netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call netfs: Fix zeropoint update where i_size > remote_i_size netfs: Fix potential for tearing in ->remote_i_size and ->zero_point ...Link: https://patch.msgid.link/20260512123404.719402-1-dhowells@redhat.comSigned-off-by: Christian Brauner List of files: /linux/fs/afs/symlink.c

c0410adf3da6db46f3513411fcf95e63c2f1d1ad - afs: Fix the locking used by afs_get_link()

Tue, 12 May 2026 14:34:01 +0200

afs: Fix the locking used by afs_get_link()The afs filesystem in the kernel doesn't do locking correctly for symboliclinks. There are a number of problems: (1) It doesn't do any locking around afs_read_single() to prevent races between multiple ->get_link() calls, thereby allowing the possibility of leaks. (2) It doesn't use RCU barriering when accessing the buffer pointers during RCU pathwalk. (3) It can race with another thread updating the contents of the symlink if a third party updated it on the server.Fix this by the following means: (0) Move symlink handling into its own file as this makes it more complicated. (1) Take the validate_lock around afs_read_single() to prevent races between multiple ->get_link() calls. (2) Keep a separate copy of the symlink contents with an rcu_head. This is always going to be a lot smaller than a page, so it can be kmalloc'd and save quite a bit of memory. It also needs a refcount for non-RCU pathwalk. (3) Split the symlink read and write-to-cache routines in afs from those for directories. (4) Discard the I/O buffer as soon as the write-to-cache completes as this is a full page (plus a folio_queue). (5) If there's no cache, discard the I/O buffer immediately after reading and copying if there is no cache.Fixes: eae9e78951bb ("afs: Use netfslib for symlinks, allowing them to be cached")Fixes: 6698c02d64b2 ("afs: Locally initialise the contents of a new symlink on creation")Closes: https://sashiko.dev/#/patchset/20260326104544.509518-1-dhowells%40redhat.comSigned-off-by: David Howells Link: https://patch.msgid.link/20260512123404.719402-25-dhowells@redhat.comcc: Marc Dionne cc: linux-afs@lists.infradead.orgcc: linux-fsdevel@vger.kernel.orgSigned-off-by: Christian Brauner List of files: /linux/fs/afs/symlink.c