linux-toradex.git/fs, branch v6.18-rc4

Merge tag 'xfs-fixes-6.18-rc4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux

2025-11-01T17:04:35+00:00

Pull xfs fixes from Carlos Maiolino:
 "Just a single bug fix (and documentation for the issue)"

* tag 'xfs-fixes-6.18-rc4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
  xfs: document another racy GC case in xfs_zoned_map_extent
  xfs: prevent gc from picking the same zone twice

Merge tag '6.18-rc3-smb-client-fixes' of git://git.samba.org/sfrench/cifs-2.6

2025-10-31T16:34:21+00:00

Pull smb client fixes from Steve French:

 - fix potential UAF in statfs

 - DFS fix for expired referrals

 - fix minor modinfo typo

 - small improvement to reconnect for smbdirect

* tag '6.18-rc3-smb-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
  smb: client: call smbd_destroy() in the same splace as kernel_sock_shutdown()/sock_release()
  smb: client: handle lack of IPC in dfs_cache_refresh()
  smb: client: fix potential cfid UAF in smb2_query_info_compound
  cifs: fix typo in enable_gcm_256 module parameter

xfs: document another racy GC case in xfs_zoned_map_extent

2025-10-31T11:06:03+00:00

Besides blocks being invalidated, there is another case when the original
mapping could have changed between querying the rmap for GC and calling
xfs_zoned_map_extent.  Document it there as it took us quite some time
to figure out what is going on while developing the multiple-GC
protection fix.

Signed-off-by: Christoph Hellwig 
Reviewed-by: Hans Holmberg 
Reviewed-by: Damien Le Moal 
Reviewed-by: Carlos Maiolino 
Reviewed-by: Darrick J. Wong 
Signed-off-by: Carlos Maiolino

xfs: prevent gc from picking the same zone twice

2025-10-31T11:06:03+00:00

When we are picking a zone for gc it might already be in the pipeline
which can lead to us moving the same data twice resulting in in write
amplification and a very unfortunate case where we keep on garbage
collecting the zone we just filled with migrated data stopping all
forward progress.

Fix this by introducing a count of on-going GC operations on a zone, and
skip any zone with ongoing GC when picking a new victim.

Fixes: 080d01c41 ("xfs: implement zoned garbage collection")
Signed-off-by: Hans Holmberg 
Co-developed-by: Hans Holmberg 
Signed-off-by: Christoph Hellwig 
Reviewed-by: Damien Le Moal 
Reviewed-by: Carlos Maiolino 
Reviewed-by: Darrick J. Wong 
Tested-by: Damien Le Moal 
Signed-off-by: Carlos Maiolino

smb: client: call smbd_destroy() in the same splace as kernel_sock_shutdown()/sock_release()

2025-10-30T01:13:13+00:00

With commit b0432201a11b ("smb: client: let destroy_mr_list() keep
smbdirect_mr_io memory if registered") the changes from commit
214bab448476 ("cifs: Call MID callback before destroying transport") and
commit 1d2a4f57cebd ("cifs:smbd When reconnecting to server, call
smbd_destroy() after all MIDs have been called") are no longer needed.

And it's better to use the same logic flow, so that
the chance of smbdirect related problems is smaller.

Fixes: 214bab448476 ("cifs: Call MID callback before destroying transport")
Fixes: 1d2a4f57cebd ("cifs:smbd When reconnecting to server, call smbd_destroy() after all MIDs have been called")
Cc: Steve French 
Cc: Tom Talpey 
Cc: Long Li 
Cc: Namjae Jeon 
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Signed-off-by: Stefan Metzmacher 
Signed-off-by: Steve French

smb: client: handle lack of IPC in dfs_cache_refresh()

2025-10-30T01:13:05+00:00

In very rare cases, DFS mounts could end up with SMB sessions without
any IPC connections.  These mounts are only possible when having
unexpired cached DFS referrals, hence not requiring any IPC
connections during the mount process.

Try to establish those missing IPC connections when refreshing DFS
referrals.  If the server is still rejecting it, then simply ignore
and leave expired cached DFS referral for any potential DFS failovers.

Reported-by: Jay Shin 
Signed-off-by: Paulo Alcantara (Red Hat) 
Cc: David Howells 
Cc: linux-cifs@vger.kernel.org
Signed-off-by: Steve French

Merge tag 'v6.18-rc3-smb-server-fixes' of git://git.samba.org/ksmbd

2025-10-29T01:00:40+00:00

Pull smb server fixes from Steve French:

 - Improve check for malformed payload

 - Fix free transport smbdirect potential race

 - Fix potential race in credit allocation during smbdirect negotiation

* tag 'v6.18-rc3-smb-server-fixes' of git://git.samba.org/ksmbd:
  smb: server: let smb_direct_cm_handler() call ib_drain_qp() after smb_direct_disconnect_rdma_work()
  smb: server: call smb_direct_post_recv_credits() when the negotiation is done
  ksmbd: transport_ipc: validate payload size before reading handle

Merge tag 'nfsd-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux

2025-10-28T19:13:20+00:00

Pull nfsd fixes from Chuck Lever:
 "Regression fixes:

   - Revert the patch that removed the cap on MAX_OPS_PER_COMPOUND

   - Address a kernel build issue

  Stable fixes:

   - Fix crash when a client queries new attributes on forechannel

   - Fix rare NFSD crash when tracing is enabled"

* tag 'nfsd-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux:
  Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND"
  nfsd: Avoid strlen conflict in nfsd4_encode_components_esc()
  NFSD: Fix crash in nfsd4_read_release()
  NFSD: Define actions for the new time_deleg FATTR4 attributes

smb: client: fix potential cfid UAF in smb2_query_info_compound

2025-10-28T13:41:36+00:00

When smb2_query_info_compound() retries, a previously allocated cfid may
have been freed in the first attempt.
Because cfid wasn't reset on replay, later cleanup could act on a stale
pointer, leading to a potential use-after-free.

Reinitialize cfid to NULL under the replay label.

Example trace (trimmed):

refcount_t: underflow; use-after-free.
WARNING: CPU: 1 PID: 11224 at ../lib/refcount.c:28 refcount_warn_saturate+0x9c/0x110
[...]
RIP: 0010:refcount_warn_saturate+0x9c/0x110
[...]
Call Trace:
 
 smb2_query_info_compound+0x29c/0x5c0 [cifs f90b72658819bd21c94769b6a652029a07a7172f]
 ? step_into+0x10d/0x690
 ? __legitimize_path+0x28/0x60
 smb2_queryfs+0x6a/0xf0 [cifs f90b72658819bd21c94769b6a652029a07a7172f]
 smb311_queryfs+0x12d/0x140 [cifs f90b72658819bd21c94769b6a652029a07a7172f]
 ? kmem_cache_alloc+0x18a/0x340
 ? getname_flags+0x46/0x1e0
 cifs_statfs+0x9f/0x2b0 [cifs f90b72658819bd21c94769b6a652029a07a7172f]
 statfs_by_dentry+0x67/0x90
 vfs_statfs+0x16/0xd0
 user_statfs+0x54/0xa0
 __do_sys_statfs+0x20/0x50
 do_syscall_64+0x58/0x80

Cc: stable@kernel.org
Fixes: 4f1fffa237692 ("cifs: commands that are retried should have replay flag set")
Reviewed-by: Paulo Alcantara (Red Hat) 
Acked-by: Shyam Prasad N 
Reviewed-by: Enzo Matsumiya 
Signed-off-by: Henrique Carvalho 
Signed-off-by: Steve French

smb: server: let smb_direct_cm_handler() call ib_drain_qp() after smb_direct_disconnect_rdma_work()

2025-10-27T01:47:32+00:00

All handlers triggered by ib_drain_qp() should already see the
broken connection.

smb_direct_cm_handler() is called under a mutex of the rdma_cm,
we should make sure ib_drain_qp() and all rdma layer logic completes
and unlocks the mutex.

It means free_transport() will also already see the connection
as SMBDIRECT_SOCKET_DISCONNECTED, so we need to call
crdma_[un]lock_handler(sc->rdma.cm_id) around
ib_drain_qp(), rdma_destroy_qp(), ib_free_cq() and ib_dealloc_pd().

Otherwise we free resources while the ib_drain_qp() within
smb_direct_cm_handler() is still running.

We have to unlock before rdma_destroy_id() as it locks again.

Fixes: 141fa9824c0f ("ksmbd: call ib_drain_qp when disconnected")
Fixes: 4c564f03e23b ("smb: server: make use of common smbdirect_socket")
Cc: Namjae Jeon 
Cc: Steve French 
Cc: Tom Talpey 
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Signed-off-by: Stefan Metzmacher 
Acked-by: Namjae Jeon 
Signed-off-by: Steve French