From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9E4C0270575 for ; Wed, 9 Sep 2026 00:25:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788913532; cv=none; b=frXVLzVdq3OalE3gJMMB3Ju4Y1vl5C4cf1LQkz9JUpmcEPzUf8M22bb2YShmZAQhV1wgLCwf4ud1xN88mOvZsFCVbZi3+dnVEiW9z1nTK0xxOcYUDirqT7dpd2tZsQh8ATNSCk6/QJChfM1iTmBafCGhue0iCagh7Q8mmojO4nw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788913532; c=relaxed/simple; bh=ozmJkrVnb+wrGhtzRMP+mUtHBB3raE8Jrl7DopY9Apk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Dm6TbapL12mEL5VmMDLeOxImwlr9X0hRAaQoV492OCfxzKenwTzyhKjsX/mALZtBnI106/2P5dOA4Xk3fFZvnv6v8Eb8vxBFI83AFxvD5kancv53PZ1FXqIaPbGUGdsTkbZ3eVUNAuXEHBxR1urvPeXYzxGoNY96S1V14YJXg5Y= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=R67uQfJG; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="R67uQfJG" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D3EDC1F00AC4; Wed, 9 Sep 2026 00:25:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788913530; bh=yNap/spK0bQamtkFmgnsMNxrLnYRr6g+7faWWvpayHc=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=R67uQfJG2yrwX+HbLC2gA6aIXE/O6/5HdbJ7fI1/duk5PiNQsI1kL4wpk3YsLBvE1 LrVIaVUiQCWPuRhRLLUDMD9c+xk7mWOSiJtZ6brmowXwIDxs0MJpQ+wmHnjZRrBkq2 3vppIvZnDSWhEpEDb1pVKWZ5iqKVryTOTixhod1an2npxLkgVkp5WDeUn4xae7Dt3Y RnqNVjjKFXi9FcaeYe77dazT8b8DA2nc80LyqQdloHd5AY6XS7xJRb3AHUruzqy4hI kGXym6qZQnRe9VOcBAAdjzDbrLH0bdiq4dh0RqBLgtMOLgeDdAwQWp93pL6XLSr/dX W5DxlqYCzbIsQ== From: Sasha Levin To: stable@vger.kernel.org Cc: Al Viro , Jeff Layton , Sasha Levin Subject: [PATCH 6.6.y 3/4] rpc_create_client_dir(): return 0 or -E... Date: Tue, 8 Sep 2026 20:25:26 -0400 Message-ID: <20260909002527.728386-3-sashal@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260909002527.728386-1-sashal@kernel.org> References: <2026090317-fame-salami-c28b@gregkh> <20260909002527.728386-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Al Viro [ Upstream commit 350db61fbeb940502a16e74153ee5954d03622e9 ] Callers couldn't care less which dentry did we get - anything valid is treated as success. Reviewed-by: Jeff Layton Signed-off-by: Al Viro For the 6.6 backport, retain rpc_mkdir_populate() and its existing rpc_clntdir_populate() callback instead of depending on the newer rpc_new_dir()/rpc_new_file() helpers. Convert the returned error pointer to an integer error and return zero after recording the directory and creating its pipe objects. Directory locking and failure cleanup remain in the existing helpers. An earlier dependency backport already converted rpc_setup_pipedir_sb() and its callers to integer status. Keep those changes and simplify the remaining rpc_create_client_dir() call to use its new return type, including the existing -EEXIST retry. No functions are added. This leaves target 932a8cf6abb2 applicable without conflicts. Stable-dep-of: 932a8cf6abb2 ("sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir") Signed-off-by: Sasha Levin --- include/linux/sunrpc/rpc_pipe_fs.h | 2 +- net/sunrpc/clnt.c | 9 +++------ net/sunrpc/rpc_pipe.c | 16 ++++++++-------- 3 files changed, 12 insertions(+), 15 deletions(-) diff --git a/include/linux/sunrpc/rpc_pipe_fs.h b/include/linux/sunrpc/rpc_pipe_fs.h index a8c0a500d55c0..571020651817e 100644 --- a/include/linux/sunrpc/rpc_pipe_fs.h +++ b/include/linux/sunrpc/rpc_pipe_fs.h @@ -98,7 +98,7 @@ static inline bool rpc_msg_is_inflight(const struct rpc_pipe_msg *msg) { } struct rpc_clnt; -extern struct dentry *rpc_create_client_dir(struct dentry *, const char *, struct rpc_clnt *); +extern int rpc_create_client_dir(struct dentry *, const char *, struct rpc_clnt *); extern int rpc_remove_client_dir(struct rpc_clnt *); extern void rpc_init_pipe_dir_head(struct rpc_pipe_dir_head *pdh); diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c index c7243d26c190d..5ccf04cdfd483 100644 --- a/net/sunrpc/clnt.c +++ b/net/sunrpc/clnt.c @@ -123,7 +123,7 @@ static int rpc_setup_pipedir_sb(struct super_block *sb, static uint32_t clntid; const char *dir_name = clnt->cl_program->pipe_dir_name; char name[15]; - struct dentry *dir, *dentry; + struct dentry *dir; int err; dir = rpc_d_lookup_sb(sb, dir_name); @@ -134,12 +134,9 @@ static int rpc_setup_pipedir_sb(struct super_block *sb, for (;;) { snprintf(name, sizeof(name), "clnt%x", (unsigned int)clntid++); name[sizeof(name) - 1] = '\0'; - dentry = rpc_create_client_dir(dir, name, clnt); - if (!IS_ERR(dentry)) { - err = 0; + err = rpc_create_client_dir(dir, name, clnt); + if (!err) break; - } - err = PTR_ERR(dentry); if (err == -EEXIST) continue; printk(KERN_INFO "RPC: Couldn't create pipefs entry" diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c index 0badbe3f25d08..0363dfb2d15c7 100644 --- a/net/sunrpc/rpc_pipe.c +++ b/net/sunrpc/rpc_pipe.c @@ -1049,19 +1049,19 @@ static void rpc_clntdir_depopulate(struct dentry *dentry) * information about the client, together with any "pipes" that may * later be created using rpc_mkpipe(). */ -struct dentry *rpc_create_client_dir(struct dentry *dentry, - const char *name, - struct rpc_clnt *rpc_client) +int rpc_create_client_dir(struct dentry *dentry, + const char *name, + struct rpc_clnt *rpc_client) { struct dentry *ret; ret = rpc_mkdir_populate(dentry, name, 0555, NULL, rpc_clntdir_populate, rpc_client); - if (!IS_ERR(ret)) { - rpc_client->cl_pipedir_objects.pdh_dentry = ret; - rpc_create_pipe_dir_objects(&rpc_client->cl_pipedir_objects); - } - return ret; + if (IS_ERR(ret)) + return PTR_ERR(ret); + rpc_client->cl_pipedir_objects.pdh_dentry = ret; + rpc_create_pipe_dir_objects(&rpc_client->cl_pipedir_objects); + return 0; } /** -- 2.53.0