Commit 0a2d650d authored by Li Lingfeng's avatar Li Lingfeng
Browse files

Revert "NFSv4: release seqid when open failed for nfs4.0" 

hulk inclusion
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAFI


CVE: CVE-2024-53173

--------------------------------

This reverts commit 7db58faf.

The issue is resolved by replace nfs_release_seqid with
nfs_release_seqid_inorder. The later patch will change nfs_release_seqid
directly and nfs_release_seqid_inorder will be not necessary any more.

Fixes: 7db58faf ("NFSv4: release seqid when open failed for nfs4.0")
Signed-off-by: default avatarLi Lingfeng <lilingfeng3@huawei.com>
parent f29c6ced

fs/nfs/nfs4_fs.h

+0 −1
Original line number Diff line number Diff line
@@ -521,7 +521,6 @@ extern struct nfs_seqid *nfs_alloc_seqid(struct nfs_seqid_counter *counter, gfp_ 
extern int nfs_wait_on_sequence(struct nfs_seqid *seqid, struct rpc_task *task);

extern void nfs_increment_open_seqid(int status, struct nfs_seqid *seqid);

extern void nfs_increment_lock_seqid(int status, struct nfs_seqid *seqid);

extern void nfs_release_seqid_inorder(struct nfs_seqid *seqid);

extern void nfs_release_seqid(struct nfs_seqid *seqid);

extern void nfs_free_seqid(struct nfs_seqid *seqid);

extern int nfs4_setup_sequence(struct nfs_client *client,

fs/nfs/nfs4proc.c

+0 −2
Original line number Diff line number Diff line
@@ -2518,8 +2518,6 @@ static void nfs4_open_release(void *calldata) 
	struct nfs4_opendata *data = calldata;

	struct nfs4_state *state = NULL;



	if (data->rpc_status != 0 || !data->rpc_done)

		nfs_release_seqid_inorder(data->o_arg.seqid);

	/* If this request hasn't been cancelled, do nothing */

	if (!data->cancelled)

		goto out_free;

fs/nfs/nfs4state.c

+0 −18
Original line number Diff line number Diff line
@@ -1088,24 +1088,6 @@ struct nfs_seqid *nfs_alloc_seqid(struct nfs_seqid_counter *counter, gfp_t gfp_m 
	return new;

}



void nfs_release_seqid_inorder(struct nfs_seqid *seqid)

{

	struct nfs_seqid_counter *sequence;



	if (seqid == NULL || list_empty(&seqid->list))

		return;

	sequence = seqid->sequence;

	spin_lock(&sequence->lock);

	if (!list_is_last(&seqid->list, &sequence->list)) {

		struct nfs_seqid *next;



		next = list_next_entry(seqid, list);

		rpc_wake_up_queued_task(&sequence->wait, next->task);

	}

	list_del_init(&seqid->list);

	spin_unlock(&sequence->lock);

}



void nfs_release_seqid(struct nfs_seqid *seqid)

{

	struct nfs_seqid_counter *sequence;