Unverified Commit bb3e8f99 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!7181 nfs: fix UAF in direct writes 

Merge Pull Request from: @ci-robot 
 
PR sync from: Long Li <leo.lilong@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/X73IJ23FCXCVH7DGGPBUFIPOWEMKTSYZ/ 
 
https://gitee.com/src-openeuler/kernel/issues/I9L5GC 
 
Link:https://gitee.com/openeuler/kernel/pulls/7181

 

Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents a391e89b 3455718a

fs/nfs/direct.c

+9 −2
Original line number Diff line number Diff line
@@ -760,10 +760,17 @@ static void nfs_direct_commit_schedule(struct nfs_direct_req *dreq) 
	LIST_HEAD(mds_list);



	nfs_init_cinfo_from_dreq(&cinfo, dreq);

	nfs_commit_begin(cinfo.mds);

	nfs_scan_commit(dreq->inode, &mds_list, &cinfo);

	res = nfs_generic_commit_list(dreq->inode, &mds_list, 0, &cinfo);

	if (res < 0) /* res == -ENOMEM */

		nfs_direct_write_reschedule(dreq);

	if (res < 0) { /* res == -ENOMEM */

		spin_lock(&dreq->lock);

		if (dreq->flags == 0)

			dreq->flags = NFS_ODIRECT_RESCHED_WRITES;

		spin_unlock(&dreq->lock);

	}

	if (nfs_commit_end(cinfo.mds))

		nfs_direct_write_complete(dreq);

}



static void nfs_direct_write_schedule_work(struct work_struct *work)

fs/nfs/write.c

+7 −3
Original line number Diff line number Diff line
@@ -1643,15 +1643,19 @@ static int wait_on_commit(struct nfs_mds_commit_info *cinfo) 
				       !atomic_read(&cinfo->rpcs_out));

}



static void nfs_commit_begin(struct nfs_mds_commit_info *cinfo)

void nfs_commit_begin(struct nfs_mds_commit_info *cinfo)

{

	atomic_inc(&cinfo->rpcs_out);

}



static void nfs_commit_end(struct nfs_mds_commit_info *cinfo)

bool nfs_commit_end(struct nfs_mds_commit_info *cinfo)

{

	if (atomic_dec_and_test(&cinfo->rpcs_out))



	if (atomic_dec_and_test(&cinfo->rpcs_out)) {

		wake_up_var(&cinfo->rpcs_out);

		return true;

	}

	return false;

}



void nfs_commitdata_release(struct nfs_commit_data *data)

include/linux/nfs_fs.h

+2 −0
Original line number Diff line number Diff line
@@ -545,6 +545,8 @@ extern int nfs_wb_page_cancel(struct inode *inode, struct page* page); 
extern int  nfs_commit_inode(struct inode *, int);

extern struct nfs_commit_data *nfs_commitdata_alloc(bool never_fail);

extern void nfs_commit_free(struct nfs_commit_data *data);

void nfs_commit_begin(struct nfs_mds_commit_info *cinfo);

bool nfs_commit_end(struct nfs_mds_commit_info *cinfo);



static inline int

nfs_have_writebacks(struct inode *inode)