Patch "afs: Fix double-unmap of directory block" has been added to the 6.18-stable tree
gregkh at linuxfoundation.org
gregkh at linuxfoundation.org
Wed Sep 16 08:59:17 PDT 2026
This is a note to let you know that I've just added the patch titled
afs: Fix double-unmap of directory block
to the 6.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
afs-fix-double-unmap-of-directory-block.patch
and it can be found in the queue-6.18 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable at vger.kernel.org> know about it.
>From e3cfd3eb7d5be7787cc69530b423f788f14d084f Mon Sep 17 00:00:00 2001
From: David Howells <dhowells at redhat.com>
Date: Wed, 2 Sep 2026 13:10:20 +0100
Subject: afs: Fix double-unmap of directory block
From: David Howells <dhowells at redhat.com>
commit e3cfd3eb7d5be7787cc69530b423f788f14d084f upstream.
Fix afs_edit_dir_remove() to use a cleanup function to unmap the block
pointed to by afs_dir_iter::block if it's left pointing to something rather
than manually kunmapping the blocks. Manually kunmapping without clearing
iter.blocks can result in a double-kunmap if afs_dir_find_block() is called
twice in a row (which would be the case if the block being modified is not
first in the hash chain).
Fixes: a5b5beebcf96 ("afs: Use the contained hashtable to search a directory")
Closes: https://sashiko.dev/#/patchset/20260716103030.3065561-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells at redhat.com>
Link: https://patch.msgid.link/20260902121024.3328255-3-dhowells@redhat.com
cc: Marc Dionne <marc.dionne at auristor.com>
cc: linux-afs at lists.infradead.org
cc: linux-fsdevel at vger.kernel.org
cc: stable at vger.kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner at kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
---
fs/afs/dir_edit.c | 9 ++-------
fs/afs/dir_search.c | 10 ++--------
fs/afs/internal.h | 8 ++++++++
3 files changed, 12 insertions(+), 15 deletions(-)
--- a/fs/afs/dir_edit.c
+++ b/fs/afs/dir_edit.c
@@ -442,7 +442,7 @@ void afs_edit_dir_remove(struct afs_vnod
/* Check and clear the entry. */
de = &block->dirents[slot];
if (de->u.valid != 1)
- goto error_unmap;
+ goto error;
trace_afs_edit_dir(vnode, why, afs_edit_dir_delete, b, slot,
ntohl(de->u.vnode), ntohl(de->u.unique),
@@ -458,7 +458,6 @@ void afs_edit_dir_remove(struct afs_vnod
/* Clear the constituent entries. */
next = de->u.hash_next;
memset(de, 0, sizeof(*de) * iter.nr_slots);
- kunmap_local(block);
/* Adjust the hash chain: if iter->prev_entry is 0, the hashtable head
* index is previous; otherwise it's slot number of the previous entry.
@@ -485,7 +484,6 @@ void afs_edit_dir_remove(struct afs_vnod
pde = &pblock->dirents[ps];
prev_next = pde->u.hash_next;
if (prev_next != htons(entry)) {
- kunmap_local(pblock);
pr_warn("%llx:%llx:%x: not prev in chain b=%x p=%x,%x e=%x %*s",
vnode->fid.vid, vnode->fid.vnode, vnode->fid.unique,
iter.bucket, iter.prev_entry, prev_next, entry,
@@ -493,7 +491,6 @@ void afs_edit_dir_remove(struct afs_vnod
goto error;
}
pde->u.hash_next = next;
- kunmap_local(pblock);
}
netfs_single_mark_inode_dirty(&vnode->netfs.inode);
@@ -503,18 +500,16 @@ void afs_edit_dir_remove(struct afs_vnod
_debug("Remove %s from %u[%u]", name->name, b, slot);
out_unmap:
+ afs_dir_end_iter(&iter);
kunmap_local(meta);
_leave("");
return;
already_invalidated:
- kunmap_local(block);
trace_afs_edit_dir(vnode, why, afs_edit_dir_delete_inval,
0, 0, 0, 0, name->name);
goto out_unmap;
-error_unmap:
- kunmap_local(block);
error:
trace_afs_edit_dir(vnode, why, afs_edit_dir_delete_error,
0, 0, 0, 0, name->name);
--- a/fs/afs/dir_search.c
+++ b/fs/afs/dir_search.c
@@ -75,10 +75,7 @@ union afs_xdr_dir_block *afs_dir_find_bl
_enter("%zx,%d", block, slot);
- if (iter->block) {
- kunmap_local(iter->block);
- iter->block = NULL;
- }
+ afs_dir_end_iter(iter);
if (dvnode->directory_size < blend)
goto fail;
@@ -174,10 +171,7 @@ int afs_dir_search_bucket(struct afs_dir
ret = -ENOENT;
found:
bad:
- if (iter->block) {
- kunmap_local(iter->block);
- iter->block = NULL;
- }
+ afs_dir_end_iter(iter);
if (ret == -ESTALE)
afs_invalidate_dir(iter->dvnode, afs_dir_invalid_iter_stale);
_leave(" = %d", ret);
--- a/fs/afs/internal.h
+++ b/fs/afs/internal.h
@@ -1129,6 +1129,14 @@ int afs_dir_search_bucket(struct afs_dir
int afs_dir_search(struct afs_vnode *dvnode, const struct qstr *name,
struct afs_fid *_fid, afs_dataversion_t *_dir_version);
+static inline void afs_dir_end_iter(struct afs_dir_iter *iter)
+{
+ if (iter->block) {
+ kunmap_local(iter->block);
+ iter->block = NULL;
+ }
+}
+
/*
* dir_silly.c
*/
Patches currently in stable-queue which might be from dhowells at redhat.com are
queue-6.18/afs-fix-double-unmap-of-directory-block.patch
queue-6.18/afs-clear-stale-peer-app-data-after-address-list-changes.patch
queue-6.18/netfs-fix-subreq-ref-leak.patch
queue-6.18/netfs-fix-unbuffered-dio-write-partial-transfer-erro.patch
queue-6.18/cachefiles-fix-potential-uaf-kasan-warning.patch
queue-6.18/netfs-fix-i_size-update-for-partial-transfer.patch
queue-6.18/netfs-break-unbuffered-write-when-netfs_alloc_subreq.patch
queue-6.18/netfs-fix-uninitialized-return-value-in-netfs_unbuffered_write.patch
queue-6.18/cachefiles-fix-double-fput.patch
queue-6.18/netfs-fix-barriering-when-walking-subrequest-list.patch
queue-6.18/netfs-fix-decision-whether-to-disallow-write-streami.patch
queue-6.18/afs-fix-missing-kunmap-in-afs_dir_search_bucket.patch
queue-6.18/netfs-fix-error-vs-transferred-passed-to-ki_complete.patch
queue-6.18/afs-fix-incorrect-free-in-candidate-cleanup-in-afs_lookup_server.patch
More information about the linux-afs
mailing list