Commit 81e72297 authored by Dai Ngo's avatar Dai Ngo Committed by Chuck Lever
Browse files

NFSD: fix problems with cleanup on errors in nfsd4_copy 



When nfsd4_copy fails to allocate memory for async_copy->cp_src, or
nfs4_init_copy_state fails, it calls cleanup_async_copy to do the
cleanup for the async_copy which causes page fault since async_copy
is not yet initialized.

This patche rearranges the order of initializing the fields in
async_copy and adds checks in cleanup_async_copy to skip un-initialized
fields.

Fixes: ce0887ac ("NFSD add nfs4 inter ssc to nfsd4_copy")
Fixes: 87689df6 ("NFSD: Shrink size of struct nfsd4_copy")
Signed-off-by: default avatarDai Ngo <dai.ngo@oracle.com>
Reviewed-by: default avatarJeff Layton <jlayton@kernel.org>
Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
parent fb610c4d

fs/nfsd/nfs4proc.c

+8 −4
Original line number Diff line number Diff line
@@ -1687,9 +1687,12 @@ static void cleanup_async_copy(struct nfsd4_copy *copy) 
{

	nfs4_free_copy_state(copy);

	release_copy_files(copy);

	if (copy->cp_clp) {

		spin_lock(&copy->cp_clp->async_lock);

	list_del(&copy->copies);

		if (!list_empty(&copy->copies))

			list_del_init(&copy->copies);

		spin_unlock(&copy->cp_clp->async_lock);

	}

	nfs4_put_copy(copy);

}
@@ -1786,12 +1789,13 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, 
		async_copy = kzalloc(sizeof(struct nfsd4_copy), GFP_KERNEL);

		if (!async_copy)

			goto out_err;

		INIT_LIST_HEAD(&async_copy->copies);

		refcount_set(&async_copy->refcount, 1);

		async_copy->cp_src = kmalloc(sizeof(*async_copy->cp_src), GFP_KERNEL);

		if (!async_copy->cp_src)

			goto out_err;

		if (!nfs4_init_copy_state(nn, copy))

			goto out_err;

		refcount_set(&async_copy->refcount, 1);

		memcpy(&copy->cp_res.cb_stateid, &copy->cp_stateid.cs_stid,

			sizeof(copy->cp_res.cb_stateid));

		dup_copy_fields(copy, async_copy);

fs/nfsd/nfs4state.c

+3 −2
Original line number Diff line number Diff line
@@ -975,7 +975,6 @@ static int nfs4_init_cp_state(struct nfsd_net *nn, copy_stateid_t *stid, 


	stid->cs_stid.si_opaque.so_clid.cl_boot = (u32)nn->boot_time;

	stid->cs_stid.si_opaque.so_clid.cl_id = nn->s2s_cp_cl_id;

	stid->cs_type = cs_type;



	idr_preload(GFP_KERNEL);

	spin_lock(&nn->s2s_cp_lock);
@@ -986,6 +985,7 @@ static int nfs4_init_cp_state(struct nfsd_net *nn, copy_stateid_t *stid, 
	idr_preload_end();

	if (new_id < 0)

		return 0;

	stid->cs_type = cs_type;

	return 1;

}
@@ -1019,7 +1019,8 @@ void nfs4_free_copy_state(struct nfsd4_copy *copy) 
{

	struct nfsd_net *nn;



	WARN_ON_ONCE(copy->cp_stateid.cs_type != NFS4_COPY_STID);

	if (copy->cp_stateid.cs_type != NFS4_COPY_STID)

		return;

	nn = net_generic(copy->cp_clp->net, nfsd_net_id);

	spin_lock(&nn->s2s_cp_lock);

	idr_remove(&nn->s2s_cp_stateids,