Commit b17fb812 authored by Chuck Lever's avatar Chuck Lever Committed by Li Lingfeng
Browse files

NFSD: Initialize struct nfsd4_copy earlier 

mainline inclusion
from mainline-v6.12-rc6
commit 63fab04cbd0f96191b6e5beedc3b643b01c15889
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB37AU
CVE: CVE-2024-50241

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=63fab04cbd0f96191b6e5beedc3b643b01c15889



----------------------------------------------------------------------

Ensure the refcount and async_copies fields are initialized early.
cleanup_async_copy() will reference these fields if an error occurs
in nfsd4_copy(). If they are not correctly initialized, at the very
least, a refcount underflow occurs.

Reported-by: default avatarOlga Kornievskaia <okorniev@redhat.com>
Fixes: aadc3bbea163 ("NFSD: Limit the number of concurrent async COPY operations")
Reviewed-by: default avatarJeff Layton <jlayton@kernel.org>
Tested-by: default avatarOlga Kornievskaia <okorniev@redhat.com>
Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>

Conflicts:
  fs/nfsd/nfs4proc.c
[Commit 8adb368675cf("[Backport] NFSD: Limit the number of concurrent
async COPY operations") miss partial indent before
"(int)rqstp->rq_pool->sp_nrthreads"]
Signed-off-by: default avatarLi Lingfeng <lilingfeng3@huawei.com>
parent cce00301

fs/nfsd/nfs4proc.c

+2 −2
Original line number Diff line number Diff line
@@ -1823,14 +1823,14 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, 
		if (!async_copy)

			goto out_err;

		async_copy->cp_nn = nn;

		INIT_LIST_HEAD(&async_copy->copies);

		refcount_set(&async_copy->refcount, 1);

		/* Arbitrary cap on number of pending async copy operations */

		if (atomic_inc_return(&nn->pending_async_copies) >

			(int)rqstp->rq_pool->sp_nrthreads) {

			atomic_dec(&nn->pending_async_copies);

			goto out_err;

		}

		INIT_LIST_HEAD(&async_copy->copies);

		refcount_set(&async_copy->refcount, 1);

		async_copy->cp_src = kmalloc(sizeof(*async_copy->cp_src), GFP_KERNEL);

		if (!async_copy->cp_src)

			goto out_err;