fs/netfs/read_collect: add to next->prev_donated
authorMax Kellermann <max.kellermann@ionos.com>
Thu, 20 Feb 2025 15:24:50 +0000 (16:24 +0100)
committerSalvatore Bonaccorso <carnil@debian.org>
Sun, 16 Mar 2025 21:08:59 +0000 (22:08 +0100)
commitf491405377615ad571501e600950ac0fc4b569da
treef0d822348038c52b677dd88b356c05dfad24d936
parent1cd741ebf58d8fdb1dcaa09dc4edca8707af8613
fs/netfs/read_collect: add to next->prev_donated

origin: https://lore.kernel.org/netfs/20250220152450.1075727-1-max.kellermann@ionos.com/
Bug-Debian: https://bugs.debian.org/1099591
Bug-Debian: https://bugs.debian.org/1098698

If multiple subrequests donate data to the same "next" request
(depending on the subrequest completion order), each of them would
overwrite the `prev_donated` field, causing data corruption and a
BUG() crash ("Can't donate prior to front").

Fixes: ee4cdf7ba857 ("netfs: Speed up buffered reading")
Closes: https://lore.kernel.org/netfs/CAKPOu+_4mUwYgQtRTbXCmi+-k3PGvLysnPadkmHOyB7Gz0iSMA@mail.gmail.com/
Cc: stable@vger.kernel.org
Signed-off-by: Max Kellermann <max.kellermann@ionos.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Gbp-Pq: Topic bugfix/all
Gbp-Pq: Name fs-netfs-read_collect-add-to-next-prev_donated.patch
fs/netfs/read_collect.c