Commit 81cbffdc authored Nov 20, 2024 by Chuck Lever Committed by Li Lingfeng Nov 20, 2024

NFSD: Initialize struct nfsd4_copy earlier

mainline inclusion
from mainline-v6.12-rc6
commit 63fab04cbd0f96191b6e5beedc3b643b01c15889
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB37AU
CVE: CVE-2024-50241

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=63fab04cbd0f96191b6e5beedc3b643b01c15889



----------------------------------------------------------------------

Ensure the refcount and async_copies fields are initialized early.
cleanup_async_copy() will reference these fields if an error occurs
in nfsd4_copy(). If they are not correctly initialized, at the very
least, a refcount underflow occurs.

Reported-by: Olga Kornievskaia <okorniev@redhat.com>
Fixes: aadc3bbea163 ("NFSD: Limit the number of concurrent async COPY operations")
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Tested-by: Olga Kornievskaia <okorniev@redhat.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>

Conflicts:
  fs/nfsd/nfs4proc.c
[Commit 81e72297("NFSD: fix problems with cleanup on errors in
nfsd4_copy") add the initialization of async_copy->copies]
Signed-off-by: Li Lingfeng <lilingfeng3@huawei.com>

parent 159042ec

fs/nfsd/nfs4proc.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1529,6 +1529,7 @@ nfsd4_copy(struct svc_rqst rqstp, struct nfsd4_compound_state cstate,
		if (!async_copy)
		goto out_err;
		async_copy->cp_nn = nn;
		refcount_set(&async_copy->refcount, 1);
		/* Arbitrary cap on number of pending async copy operations */
		if (atomic_inc_return(&nn->pending_async_copies) >
		(int)rqstp->rq_pool->sp_nrthreads) {
		@@ -1537,7 +1538,6 @@ nfsd4_copy(struct svc_rqst rqstp, struct nfsd4_compound_state cstate,
		}
		if (!nfs4_init_copy_state(nn, copy))
		goto out_err;
		refcount_set(&async_copy->refcount, 1);
		memcpy(&copy->cp_res.cb_stateid, &copy->cp_stateid.stid,
		sizeof(copy->cp_res.cb_stateid));
		dup_copy_fields(copy, async_copy);