Commit 66b3f1fd authored by Guoqing Jiang's avatar Guoqing Jiang Committed by Li Lingfeng
Browse files

nfsd: call cache_put if xdr_reserve_space returns NULL 

stable inclusion
from stable-v6.6.54
commit a1afbbb5276f943ad7173d0b4c626b8c75a260da
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYQRM
CVE: CVE-2024-47737

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a1afbbb5276f943ad7173d0b4c626b8c75a260da



--------------------------------

[ Upstream commit d078cbf5c38de83bc31f83c47dcd2184c04a50c7 ]

If not enough buffer space available, but idmap_lookup has triggered
lookup_fn which calls cache_get and returns successfully. Then we
missed to call cache_put here which pairs with cache_get.

Fixes: ddd1ea56 ("nfsd4: use xdr_reserve_space in attribute encoding")
Signed-off-by: default avatarGuoqing Jiang <guoqing.jiang@linux.dev>
Reviwed-by: default avatarJeff Layton <jlayton@kernel.org>
Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarLi Lingfeng <lilingfeng3@huawei.com>
parent b436b5d3

fs/nfsd/nfs4idmap.c

+9 −4
Original line number Diff line number Diff line
@@ -581,6 +581,7 @@ static __be32 idmap_id_to_name(struct xdr_stream *xdr, 
		.id = id,

		.type = type,

	};

	__be32 status = nfs_ok;

	__be32 *p;

	int ret;

	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
@@ -593,12 +594,16 @@ static __be32 idmap_id_to_name(struct xdr_stream *xdr, 
		return nfserrno(ret);

	ret = strlen(item->name);

	WARN_ON_ONCE(ret > IDMAP_NAMESZ);



	p = xdr_reserve_space(xdr, ret + 4);

	if (!p)

		return nfserr_resource;

	p = xdr_encode_opaque(p, item->name, ret);

	if (unlikely(!p)) {

		status = nfserr_resource;

		goto out_put;

	}

	xdr_encode_opaque(p, item->name, ret);

out_put:

	cache_put(&item->h, nn->idtoname_cache);

	return 0;

	return status;

}



static bool