From: Mike Snitzer snitzer@kernel.org

commit 3af870aedbff10bfed220e280b57a405e972229f upstream.

Commit f2060bdc21d7 ("nfs/localio: add refcounting for each iocb IO associated with NFS pgio header") inadvertantly reintroduced the same potential for __put_cred() triggering BUG_ON(cred == current->cred) that commit 992203a1fba5 ("nfs/localio: restore creds before releasing pageio data") fixed.

Fix this by saving and restoring the cred around each {read,write}_iter call within the respective for loop of nfs_local_call_{read,write}.

Reported-by: Zorro Lang zlang@redhat.com Fixes: f2060bdc21d7 ("nfs/localio: add refcounting for each iocb IO associated with NFS pgio header") Cc: stable@vger.kernel.org # 6.18.x Signed-off-by: Mike Snitzer snitzer@kernel.org Signed-off-by: Trond Myklebust trond.myklebust@hammerspace.com --- fs/nfs/localio.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/fs/nfs/localio.c b/fs/nfs/localio.c index 656976b4f42c..ee635172d68a 100644 --- a/fs/nfs/localio.c +++ b/fs/nfs/localio.c @@ -625,8 +625,6 @@ static void nfs_local_call_read(struct work_struct *work) ssize_t status; int n_iters;

- save_cred = override_creds(filp->f_cred); - n_iters = atomic_read(&iocb->n_iters); for (int i = 0; i < n_iters ; i++) { if (iocb->iter_is_dio_aligned[i]) { @@ -639,7 +637,10 @@ static void nfs_local_call_read(struct work_struct *work) } else iocb->kiocb.ki_flags &= ~IOCB_DIRECT;

+ save_cred = override_creds(filp->f_cred); status = filp->f_op->read_iter(&iocb->kiocb, &iocb->iters[i]); + revert_creds(save_cred); + if (status != -EIOCBQUEUED) { if (unlikely(status >= 0 && status < iocb->iters[i].count)) force_done = true; /* Partial read */ @@ -649,8 +650,6 @@ static void nfs_local_call_read(struct work_struct *work) } } } - - revert_creds(save_cred); }

static int @@ -832,7 +831,6 @@ static void nfs_local_call_write(struct work_struct *work) int n_iters;

current->flags |= PF_LOCAL_THROTTLE | PF_MEMALLOC_NOIO; - save_cred = override_creds(filp->f_cred);

file_start_write(filp); n_iters = atomic_read(&iocb->n_iters); @@ -847,7 +845,10 @@ static void nfs_local_call_write(struct work_struct *work) } else iocb->kiocb.ki_flags &= ~IOCB_DIRECT;

+ save_cred = override_creds(filp->f_cred); status = filp->f_op->write_iter(&iocb->kiocb, &iocb->iters[i]); + revert_creds(save_cred); + if (status != -EIOCBQUEUED) { if (unlikely(status >= 0 && status < iocb->iters[i].count)) force_done = true; /* Partial write */ @@ -859,7 +860,6 @@ static void nfs_local_call_write(struct work_struct *work) } file_end_write(filp);

- revert_creds(save_cred); current->flags = old_flags; }