[PATCH] nfs/localio: fix regression due to out-of-order __put_cred

[PATCH] nfs/localio: fix regression due to out-of-order __put_cred

[Trond Myklebust]

From: Mike Snitzer <snitzer@kernel.org>

commit 3af870aedbff10bfed220e280b57a405e972229f upstream.

Commit f2060bdc21d7 ("nfs/localio: add refcounting for each iocb IO
associated with NFS pgio header") inadvertantly reintroduced the same
potential for __put_cred() triggering BUG_ON(cred == current->cred)
that commit 992203a1fba5 ("nfs/localio: restore creds before releasing
pageio data") fixed.

Fix this by saving and restoring the cred around each {read,write}_iter
call within the respective for loop of nfs_local_call_{read,write}.

Reported-by: Zorro Lang <zlang@redhat.com>
Fixes: f2060bdc21d7 ("nfs/localio: add refcounting for each iocb IO associated with NFS pgio header")
Cc: <stable@vger.kernel.org> # 6.18.x
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
---
 fs/nfs/localio.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/fs/nfs/localio.c b/fs/nfs/localio.c
index 656976b4f42c..ee635172d68a 100644
--- a/fs/nfs/localio.c
+++ b/fs/nfs/localio.c
@@ -625,8 +625,6 @@ static void nfs_local_call_read(struct work_struct *work)
 	ssize_t status;
 	int n_iters;
 
-	save_cred = override_creds(filp->f_cred);
-
 	n_iters = atomic_read(&iocb->n_iters);
 	for (int i = 0; i < n_iters ; i++) {
 		if (iocb->iter_is_dio_aligned[i]) {
@@ -639,7 +637,10 @@ static void nfs_local_call_read(struct work_struct *work)
 		} else
 			iocb->kiocb.ki_flags &= ~IOCB_DIRECT;
 
+		save_cred = override_creds(filp->f_cred);
 		status = filp->f_op->read_iter(&iocb->kiocb, &iocb->iters[i]);
+		revert_creds(save_cred);
+
 		if (status != -EIOCBQUEUED) {
 			if (unlikely(status >= 0 && status < iocb->iters[i].count))
 				force_done = true; /* Partial read */
@@ -649,8 +650,6 @@ static void nfs_local_call_read(struct work_struct *work)
 			}
 		}
 	}
-
-	revert_creds(save_cred);
 }
 
 static int
@@ -832,7 +831,6 @@ static void nfs_local_call_write(struct work_struct *work)
 	int n_iters;
 
 	current->flags |= PF_LOCAL_THROTTLE | PF_MEMALLOC_NOIO;
-	save_cred = override_creds(filp->f_cred);
 
 	file_start_write(filp);
 	n_iters = atomic_read(&iocb->n_iters);
@@ -847,7 +845,10 @@ static void nfs_local_call_write(struct work_struct *work)
 		} else
 			iocb->kiocb.ki_flags &= ~IOCB_DIRECT;
 
+		save_cred = override_creds(filp->f_cred);
 		status = filp->f_op->write_iter(&iocb->kiocb, &iocb->iters[i]);
+		revert_creds(save_cred);
+
 		if (status != -EIOCBQUEUED) {
 			if (unlikely(status >= 0 && status < iocb->iters[i].count))
 				force_done = true; /* Partial write */
@@ -859,7 +860,6 @@ static void nfs_local_call_write(struct work_struct *work)
 	}
 	file_end_write(filp);
 
-	revert_creds(save_cred);
 	current->flags = old_flags;
 }
 
-- 
2.52.0

Re: [PATCH] nfs/localio: fix regression due to out-of-order __put_cred

[Greg KH]

On Sat, Dec 06, 2025 at 07:24:14PM -0500, Trond Myklebust wrote:
> From: Mike Snitzer <snitzer@kernel.org>
> 
> commit 3af870aedbff10bfed220e280b57a405e972229f upstream.
> 
> Commit f2060bdc21d7 ("nfs/localio: add refcounting for each iocb IO
> associated with NFS pgio header") inadvertantly reintroduced the same
> potential for __put_cred() triggering BUG_ON(cred == current->cred)
> that commit 992203a1fba5 ("nfs/localio: restore creds before releasing
> pageio data") fixed.
> 
> Fix this by saving and restoring the cred around each {read,write}_iter
> call within the respective for loop of nfs_local_call_{read,write}.
> 
> Reported-by: Zorro Lang <zlang@redhat.com>
> Fixes: f2060bdc21d7 ("nfs/localio: add refcounting for each iocb IO associated with NFS pgio header")
> Cc: <stable@vger.kernel.org> # 6.18.x
> Signed-off-by: Mike Snitzer <snitzer@kernel.org>
> Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
> ---

What kernel is this for, just 6.18.y?  And why was the changelog
rewritten/formatted from the original?

thanks,

greg k-h

Re: [PATCH] nfs/localio: fix regression due to out-of-order __put_cred

[Trond Myklebust]

On Sun, 2025-12-07 at 09:42 +0900, Greg KH wrote:
> On Sat, Dec 06, 2025 at 07:24:14PM -0500, Trond Myklebust wrote:
> > From: Mike Snitzer <snitzer@kernel.org>
> > 
> > commit 3af870aedbff10bfed220e280b57a405e972229f upstream.
> > 
> > Commit f2060bdc21d7 ("nfs/localio: add refcounting for each iocb IO
> > associated with NFS pgio header") inadvertantly reintroduced the
> > same
> > potential for __put_cred() triggering BUG_ON(cred == current->cred)
> > that commit 992203a1fba5 ("nfs/localio: restore creds before
> > releasing
> > pageio data") fixed.
> > 
> > Fix this by saving and restoring the cred around each
> > {read,write}_iter
> > call within the respective for loop of nfs_local_call_{read,write}.
> > 
> > Reported-by: Zorro Lang <zlang@redhat.com>
> > Fixes: f2060bdc21d7 ("nfs/localio: add refcounting for each iocb IO
> > associated with NFS pgio header")
> > Cc: <stable@vger.kernel.org> # 6.18.x
> > Signed-off-by: Mike Snitzer <snitzer@kernel.org>
> > Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
> > ---
> 
> What kernel is this for, just 6.18.y?  And why was the changelog
> rewritten/formatted from the original?
> 

The patch is just for 6.18.y. It is actually the original patch that
was submitted in the last week of the 6.18-rc series. That patch didn't
make it in before 6.18 was released due to the Thanksgiving holiday,
etc.

When commits 94afb627dfc2 and bff3c841f7bd were merged early in the
6.19 merge window, a port was required in order to match up the fix to
the new "scoped_with_creds()" paradigm. While that port could be
backported as is, it would require pulling in the full framework for
"scoped_with_creds()", hence the preference for just submitting the
original patch.


-- 
Trond Myklebust
Linux NFS client maintainer, Hammerspace
trondmy@kernel.org, trond.myklebust@hammerspace.com