Patch "afs: Fix afs_dynroot_readdir() to not use the RCU read lock" has been added to the 6.12-stable tree

[gregkh at linuxfoundation.org]

This is a note to let you know that I've just added the patch titled

    afs: Fix afs_dynroot_readdir() to not use the RCU read lock

to the 6.12-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     afs-fix-afs_dynroot_readdir-to-not-use-the-rcu-read-lock.patch
and it can be found in the queue-6.12 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable at vger.kernel.org> know about it.


>From a64e4d48a0b77e4ada19ac26ca3a08cd492f6362 Mon Sep 17 00:00:00 2001
From: David Howells <dhowells at redhat.com>
Date: Tue, 8 Apr 2025 21:46:29 +0100
Subject: afs: Fix afs_dynroot_readdir() to not use the RCU read lock

From: David Howells <dhowells at redhat.com>

commit a64e4d48a0b77e4ada19ac26ca3a08cd492f6362 upstream.

afs_dynroot_readdir() uses the RCU read lock to walk the cell list whilst
emitting cell automount entries - but dir_emit() may write to a userspace
buffer, thereby causing a fault to occur and waits to happen.

Fix afs_dynroot_readdir() to get a shared lock on net->cells_lock instead.

This can be triggered by enabling lockdep, preconfiguring a number of
cells, doing "mount -t afs none /afs -o dyn" (or using the kafs-client
package with afs.mount systemd unit enabled) and then doing "ls /afs".

Fixes: 1d0b929fc070 ("afs: Change dynroot to create contents on demand")
Reported-by: syzbot+3b6c5c6a1d0119b687a1 at syzkaller.appspotmail.com
Reported-by: syzbot+8245611446194a52150d at syzkaller.appspotmail.com
Reported-by: syzbot+1aa62e6852a6ad1c7944 at syzkaller.appspotmail.com
Reported-by: syzbot+54e6c2176ba76c56217e at syzkaller.appspotmail.com
Signed-off-by: David Howells <dhowells at redhat.com>
Link: https://lore.kernel.org/1638014.1744145189@warthog.procyon.org.uk
cc: Marc Dionne <marc.dionne at auristor.com>
cc: linux-afs at lists.infradead.org
cc: linux-fsdevel at vger.kernel.org
Signed-off-by: Christian Brauner <brauner at kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
---
 fs/afs/dynroot.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/fs/afs/dynroot.c
+++ b/fs/afs/dynroot.c
@@ -347,9 +347,9 @@ static int afs_dynroot_readdir(struct fi
 	}
 
 	if ((unsigned long long)ctx->pos <= AFS_MAX_DYNROOT_CELL_INO) {
-		rcu_read_lock();
+		down_read(&net->cells_lock);
 		ret = afs_dynroot_readdir_cells(net, ctx);
-		rcu_read_unlock();
+		up_read(&net->cells_lock);
 	}
 	return ret;
 }


Patches currently in stable-queue which might be from dhowells at redhat.com are

queue-6.12/afs-fix-error-code-in-afs_extract_vl_addrs.patch
queue-6.12/afs-add-rootcell-checks.patch
queue-6.12/afs-fix-missing-null-pointer-check-in-afs_break_some.patch
queue-6.12/rxrpc-rxrpc_verify_data-ensure-rx_dec_buffer-alloc.patch
queue-6.12/afs-make-afs-.-cell-as-well-as-afs-cell-mountpoints.patch
queue-6.12/netfs-fix-writeback-error-handling.patch
queue-6.12/afs-fix-further-netns-teardown-to-cancel-the-preallocation-charger.patch
queue-6.12/afs-fix-netns-teardown-to-cancel-the-preallocation-charger.patch
queue-6.12/afs-fix-afs_dynroot_readdir-to-not-use-the-rcu-read-lock.patch
queue-6.12/afs-fix-misplaced-inc-of-net-cells_outstanding.patch
queue-6.12/afs-use-kvfree-to-free-memory-allocated-by-kvcalloc.patch
queue-6.12/netfs-drop-the-error-arg-from-netfs_read_subreq_term.patch
queue-6.12/cifs-fix-missing-credit-release-on-failure-in-cifs_i.patch
queue-6.12/afs-fix-afs_atcell_get_link-to-handle-rcu-pathwalk.patch
queue-6.12/afs-fix-unchecked-length-string-display-in-debug-sta.patch
queue-6.12/afs-fix-vllist-leak.patch
queue-6.12/rxrpc-fix-leak-of-released-call-in-recvmsg-msg_peek.patch
queue-6.12/afs-fix-double-netfs-initialisation-in-afs_root_iget.patch
queue-6.12/afs-fix-null-pointer-dereference-in-afs_get_tree.patch
queue-6.12/afs-fix-the-volume-afs_volume_rm_tree-is-set-on.patch
queue-6.12/afs-remove-erroneous-seq-1-in-volume-lookup-loop.patch
queue-6.12/afs-fix-callback-service-message-parsers-to-pass-thr.patch
queue-6.12/afs-fix-afs_atcell_get_link-to-check-if-ws_cell-is-unset-first.patch
queue-6.12/afs-make-afs-cell-and-afs-.-cell-symlinks.patch
queue-6.12/afs-remove-the-autocell-mount-option.patch
queue-6.12/afs-change-dynroot-to-create-contents-on-demand.patch