From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793818610; b=bI8qDxVUxAvMBeCrCjwqF2NPRNWzuo2MuQv3SO2psmOVy1dLwd4yPjjmX9xKUIANa/g4 OrHUM4iVcEB0dMvOkdhRS5tKU1lksz40FP6Drmv9x2cy+BB+WwupYvzT9aDSeDRRej04O duOM2TTW+ayyczqOiJueW/zHPRUCTibNm766HXqGjpV3PHYt0HKojxCn0w0JNO/uzhMCS rb8m617XhjfxV2Quo0k2jOveDuyeH0lLfm4m+vvH7UBEHJViLIfmjcv4hmgdYeeaRcRUW 84rMk3lFqTbdbdJBUPyOyToXgVR7rOTGTcV8nasrIV6Hwu8nSdgPYkWZiWTilFZ0/sw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793818610; h=Received:DKIM-Signature:Subject:To:Cc:From:Date:Message-ID: MIME-Version:Content-Type:Content-Transfer-Encoding; bh=pFMuMADhTP/GFHVP2M5Tfmm5siw238LwvYgFdWGEVv4=; b=FcjHQnoYWaFrFbpXsEp9jJqaQp4G0nRS9664HeM/Z2pjmvTa5Kda3Gbgq/SevTHDQc2C gPASGdnEEdCSigzEtpe/ES3ClZ4l4fIa1eC4lfcagdmzQdFYyZfNWAHI7HbrEGlxue3iK LyBVUnA+EJ74kgmCoz5CP0h38lqfgn8UmrDZ0YjdAVcTWXrwNlxwwGEGcTQqdR/Mv7Bc6 zVi8AxHzYW8NMsk2oSY3vBClFTAtVbpz6EFmVR1e+VP4opN3p0tDktl8UaUdHPO/gRuxZ /8dNGALSIGyZio9qClBA/gLZKv6VU/uBo4uHZNQBUY53pJC9ZdJ7ItO03UaXv1NJi6A== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=HAiBvDD8; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4E9BA606EE86 for ; Wed, 4 Nov 2026 18:56:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=HAiBvDD8 Received: by smtp.kernel.org (Postfix) with ESMTPSA id C50E81F000C1; Wed, 4 Nov 2026 18:56:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793818610; bh=pFMuMADhTP/GFHVP2M5Tfmm5siw238LwvYgFdWGEVv4=; h=Subject:To:Cc:From:Date; b=HAiBvDD8xn14d/jXXa4pmSSPFlHw8mZ6qmcIIE6t6dL9+ddzLeSnD7lo274KB+tvO 91owz3IzRNGcfxN0UxcBHFlxxIxbBhEaGIq5oPOfFbKUKHTUE/fglT7QJ4rlp1345i HXDdcNavqSM69dkb/8Hedki0zlIaGyWDMNJKb1HI= Subject: FAILED: patch "[PATCH] NFSD: Complete a cld upcall when copying its reply fails" failed to apply to 6.6-stable tree To: cel@kernel.org Cc: From: Date: Wed, 04 Nov 2026 13:56:45 -0500 Message-ID: <2026110445-revenge-computing-e665@gregkh> X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit The patch below does not apply to the 6.6-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y git checkout FETCH_HEAD git cherry-pick -x 8cef2b0a01d28647facc57501a3df7ccd8d13ccd # git commit -s git send-email --to '' --in-reply-to '2026110445-revenge-computing-e665@gregkh' --subject-prefix 'PATCH 6.6.y' 'HEAD^..' Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 8cef2b0a01d28647facc57501a3df7ccd8d13ccd Mon Sep 17 00:00:00 2001 From: Chuck Lever Date: Tue, 1 Sep 2026 16:19:43 -0400 Subject: [PATCH] NFSD: Complete a cld upcall when copying its reply fails cld_pipe_downcall() removes the matching upcall from cn_list before copying the daemon's reply. When that copy_from_user() faults, the downcall returns -EFAULT without completing the upcall, and a retried write cannot reach it because its xid is no longer on the list. __cld_pipe_upcall() waits on cu_done uninterruptibly, so the nfsd thread that sent the upcall is stuck, and nfsd shutdown hangs behind it. The pipe is mode 0600, so only a broken or hostile nfsdcld can trigger the fault. Record the fault in the upcall's pipe message and complete it, so the waiter returns the error to its client tracking operation. Fixes: f3f8014862d8 ("nfsd: add the infrastructure to handle the cld upcall") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260901-alemi-v2-3-e163f94a3a6e@kernel.org Signed-off-by: Chuck Lever diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c index 8dff351aa832..999694db9981 100644 --- a/fs/nfsd/nfs4recover.c +++ b/fs/nfsd/nfs4recover.c @@ -835,8 +835,11 @@ cld_pipe_downcall(struct file *filp, const char __user *src, size_t mlen) if (status == -EINPROGRESS) return __cld_pipe_inprogress_downcall(cmsg, nn); - if (copy_from_user(&cup->cu_u.cu_msg_v2, src, mlen) != 0) + if (copy_from_user(&cup->cu_u.cu_msg_v2, src, mlen) != 0) { + cup->cu_pipe_msg.errno = -EFAULT; + complete(&cup->cu_done); return -EFAULT; + } complete(&cup->cu_done); return mlen;