Commit 99577bc2 authored by Chuck Lever's avatar Chuck Lever Committed by Li Lingfeng
Browse files

NFSD: Never decrement pending_async_copies on error 

mainline inclusion
from mainline-v6.12-rc6
commit 8286f8b622990194207df9ab852e0f87c60d35e9
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5KQU
CVE: CVE-2024-53073

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=8286f8b622990194207df9ab852e0f87c60d35e9



----------------------------------------------------------------------

The error flow in nfsd4_copy() calls cleanup_async_copy(), which
already decrements nn->pending_async_copies.

Reported-by: default avatarOlga Kornievskaia <okorniev@redhat.com>
Fixes: aadc3bbea163 ("NFSD: Limit the number of concurrent async COPY operations")
Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>

Conflicts:
  fs/nfsd/nfs4proc.c
[Commit 87689df6("NFSD: Shrink size of struct nfsd4_copy") add the
allocation of cp_src.]
Signed-off-by: default avatarLi Lingfeng <lilingfeng3@huawei.com>
parent 7a23fb4d

fs/nfsd/nfs4proc.c

+1 −3
Original line number Diff line number Diff line
@@ -1532,10 +1532,8 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, 
		refcount_set(&async_copy->refcount, 1);

		/* Arbitrary cap on number of pending async copy operations */

		if (atomic_inc_return(&nn->pending_async_copies) >

				(int)rqstp->rq_pool->sp_nrthreads) {

			atomic_dec(&nn->pending_async_copies);

				(int)rqstp->rq_pool->sp_nrthreads)

			goto out_err;

		}

		if (!nfs4_init_copy_state(nn, copy))

			goto out_err;

		memcpy(&copy->cp_res.cb_stateid, &copy->cp_stateid.stid,