orangefs: fix double-free of trailer_buf
 orangefs: skip leading spaces before parsing client debug masks
 
 Cleanup:
 orangefs: Remove commented out code
 
 New:
 orangefs: use folio_pos() and folio_size() in orangefs_page_mkwrite()
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEWLOQAZkv9m2xtUCf/Vh1C1u0YnAFAmqEfo8ACgkQ/Vh1C1u0
 YnCw7g/6A8tslelLuzkjMtF91rNpSQZtluVqT84CclmxFCChFlUI/M7fLgvnntph
 8EQ70clSfiKsTgqnB0P0PQrIyxgY/fVgOFFGT6SBrl2iHr9rqF7nkv1GH5Ymn/W6
 WhMmYKPiES0yZyNOchOBr35v7BG5m26FJfGzBCTxmTwo5SeqBziaGcR5lBT9pIoB
 z89Aa+x6BI3GOG3d8bOCnmiDJqypyaVzUqBIccJaWVUkxT9svZo51hHweaM/GF9w
 XC8DYrkR7bOb4IV+GU2vLKFn1r4PAMq720aVRtvWWm+LOpszhVCxafu4w/kqbaWl
 1T8UHoAEGVSN8I3EJSc2gbZ7ZjoY6WCSOBSlN9I7xWy4HRt1zZ+FBPp5UGvhlcyU
 jznhhufik6dvBdHLd78yJBcrQRYfD35aWRIlPnJs4Z72AYX3+oLL2wvyM0SNd0aF
 IQ35GheSdlpUsYHZHZyFaK3Iw68VcOoYtCl+7DQhrhFwHz9NvDXgSW3wJI064yBU
 wf/Y4xAxy13A6o8FLzOk6jBZJ3OpaqcKO9liIXiq0yZ/uLikhXv096Ags4XArJh+
 oS21vd1gUqN2xCaFJcrSktjmVkCdXLHo94HKZ6A+jx82xyByeprJMmPJPP9EBt3Y
 cUgFSfraAh2dZ+zxVZ/my5qrPo/7hP4IXo35fyMiR41m14wsgkI=
 =n1xT
 -----END PGP SIGNATURE-----

Merge tag 'for-linus-7.3-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux

Pull orangefs updates from Mike Marshall:
 "Fixes:
   - fix double-free of trailer_buf
   - skip leading spaces before parsing client debug masks

  Cleanup:
   - Remove commented out code

  New:
   - use folio_pos() and folio_size() in orangefs_page_mkwrite()"

* tag 'for-linus-7.3-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux:
  orangefs: skip leading spaces before parsing client debug masks
  orangefs: Remove commented out code in find_cached_xattr
  orangefs: use folio_pos() and folio_size() in orangefs_page_mkwrite()
  orangefs: fix double-free of trailer_buf on readdir copy failure
This commit is contained in:
Linus Torvalds 2026-08-20 12:36:26 -07:00
commit ada9ccfb81
4 changed files with 6 additions and 9 deletions

View File

@ -474,6 +474,7 @@ static ssize_t orangefs_devreq_write_iter(struct kiocb *iocb,
op->downcall.trailer_size, iter)) {
gossip_err("%s: failed to copy trailer.\n", __func__);
vfree(op->downcall.trailer_buf);
op->downcall.trailer_buf = NULL;
goto Efault;
}

View File

@ -652,8 +652,8 @@ vm_fault_t orangefs_page_mkwrite(struct vm_fault *vmf)
wr = folio_get_private(folio);
if (uid_eq(wr->uid, current_fsuid()) &&
gid_eq(wr->gid, current_fsgid())) {
wr->pos = page_offset(vmf->page);
wr->len = PAGE_SIZE;
wr->pos = folio_pos(folio);
wr->len = folio_size(folio);
goto okay;
} else {
if (orangefs_launder_folio(folio)) {
@ -667,8 +667,8 @@ vm_fault_t orangefs_page_mkwrite(struct vm_fault *vmf)
ret = VM_FAULT_LOCKED|VM_FAULT_RETRY;
goto out;
}
wr->pos = page_offset(vmf->page);
wr->len = PAGE_SIZE;
wr->pos = folio_pos(folio);
wr->len = folio_size(folio);
wr->uid = current_fsuid();
wr->gid = current_fsgid();
folio_attach_private(folio, wr);

View File

@ -569,6 +569,7 @@ static int orangefs_prepare_cdm_array(char *debug_array_string)
cds_delimiter = strchr(cds_head, '\n');
*cds_delimiter = '\0';
cds_head = skip_spaces(cds_head);
keyword_len = strcspn(cds_head, " ");
cdm_array[i].keyword = kzalloc(keyword_len + 1, GFP_KERNEL);

View File

@ -72,11 +72,6 @@ static struct orangefs_cached_xattr *find_cached_xattr(struct inode *inode,
if (hlist_empty(h))
return NULL;
hlist_for_each_entry_safe(cx, tmp, h, node) {
/* if (!time_before(jiffies, cx->timeout)) {
hlist_del(&cx->node);
kfree(cx);
continue;
}*/
if (!strcmp(cx->key, key))
return cx;
}