From b17fb8124dd28126510cbdc1f34155d508f45142 Mon Sep 17 00:00:00 2001 From: Chuck Lever Date: Wed, 20 Nov 2024 14:38:47 +0800 Subject: [PATCH] NFSD: Initialize struct nfsd4_copy earlier mainline inclusion from mainline-v6.12-rc6 commit 63fab04cbd0f96191b6e5beedc3b643b01c15889 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB37AU CVE: CVE-2024-50241 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=63fab04cbd0f96191b6e5beedc3b643b01c15889 ---------------------------------------------------------------------- Ensure the refcount and async_copies fields are initialized early. cleanup_async_copy() will reference these fields if an error occurs in nfsd4_copy(). If they are not correctly initialized, at the very least, a refcount underflow occurs. Reported-by: Olga Kornievskaia Fixes: aadc3bbea163 ("NFSD: Limit the number of concurrent async COPY operations") Reviewed-by: Jeff Layton Tested-by: Olga Kornievskaia Signed-off-by: Chuck Lever Conflicts: fs/nfsd/nfs4proc.c [Commit 8adb368675cf("[Backport] NFSD: Limit the number of concurrent async COPY operations") miss partial indent before "(int)rqstp->rq_pool->sp_nrthreads"] Signed-off-by: Li Lingfeng --- fs/nfsd/nfs4proc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index 9b672ba7d02b..34d9931df6a4 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -1823,14 +1823,14 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, if (!async_copy) goto out_err; async_copy->cp_nn = nn; + INIT_LIST_HEAD(&async_copy->copies); + refcount_set(&async_copy->refcount, 1); /* Arbitrary cap on number of pending async copy operations */ if (atomic_inc_return(&nn->pending_async_copies) > (int)rqstp->rq_pool->sp_nrthreads) { atomic_dec(&nn->pending_async_copies); goto out_err; } - INIT_LIST_HEAD(&async_copy->copies); - refcount_set(&async_copy->refcount, 1); async_copy->cp_src = kmalloc(sizeof(*async_copy->cp_src), GFP_KERNEL); if (!async_copy->cp_src) goto out_err; -- Gitee