Unverified Commit 8caff8af authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!7044 v2 nfs: fix UAF in direct writes 

Merge Pull Request from: @ci-robot 
 
PR sync from: Long Li <leo.lilong@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/KKPTCS5LERCRMFQ3NR42GS6LMJSHHUT4/ 
 
https://gitee.com/openeuler/kernel/issues/I9L5GC 
 
Link:https://gitee.com/openeuler/kernel/pulls/7044

 

Reviewed-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 762b5224 bf3858da

fs/nfs/direct.c

+9 −2
Original line number Diff line number Diff line
@@ -678,10 +678,17 @@ static void nfs_direct_commit_schedule(struct nfs_direct_req *dreq) 
	LIST_HEAD(mds_list);



	nfs_init_cinfo_from_dreq(&cinfo, dreq);

	nfs_commit_begin(cinfo.mds);

	nfs_scan_commit(dreq->inode, &mds_list, &cinfo);

	res = nfs_generic_commit_list(dreq->inode, &mds_list, 0, &cinfo);

	if (res < 0) /* res == -ENOMEM */

		nfs_direct_write_reschedule(dreq);

	if (res < 0) { /* res == -ENOMEM */

		spin_lock(&dreq->lock);

		if (dreq->flags == 0)

			dreq->flags = NFS_ODIRECT_RESCHED_WRITES;

		spin_unlock(&dreq->lock);

	}

	if (nfs_commit_end(cinfo.mds))

		nfs_direct_write_complete(dreq);

}



static void nfs_direct_write_clear_reqs(struct nfs_direct_req *dreq)

fs/nfs/write.c

+1 −1
Original line number Diff line number Diff line
@@ -1634,7 +1634,7 @@ static int wait_on_commit(struct nfs_mds_commit_info *cinfo) 
				       !atomic_read(&cinfo->rpcs_out));

}



static void nfs_commit_begin(struct nfs_mds_commit_info *cinfo)

void nfs_commit_begin(struct nfs_mds_commit_info *cinfo)

{

	atomic_inc(&cinfo->rpcs_out);

}

include/linux/nfs_fs.h

+1 −0
Original line number Diff line number Diff line
@@ -553,6 +553,7 @@ extern int nfs_wb_page_cancel(struct inode *inode, struct page* page); 
extern int  nfs_commit_inode(struct inode *, int);

extern struct nfs_commit_data *nfs_commitdata_alloc(void);

extern void nfs_commit_free(struct nfs_commit_data *data);

void nfs_commit_begin(struct nfs_mds_commit_info *cinfo);

bool nfs_commit_end(struct nfs_mds_commit_info *cinfo);



static inline int