diff options
| author | Chuck Lever <chuck.lever@oracle.com> | 2024-10-26 12:02:38 -0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-11-08 16:30:52 +0100 |
| commit | e30a9a2f69c34a00a3cb4fd45c5d231929e66fb1 (patch) | |
| tree | 6d814b4b1ecae05835ffe98b9cb9dd1bcacc1309 /fs | |
| parent | 4301a6db1be14f760e03e7dbd55d1e7b59eb752f (diff) | |
| download | linux-e30a9a2f69c34a00a3cb4fd45c5d231929e66fb1.tar.gz linux-e30a9a2f69c34a00a3cb4fd45c5d231929e66fb1.tar.bz2 linux-e30a9a2f69c34a00a3cb4fd45c5d231929e66fb1.zip | |
NFSD: Initialize struct nfsd4_copy earlier
[ Upstream commit 63fab04cbd0f96191b6e5beedc3b643b01c15889 ]
Ensure the refcount and async_copies fields are initialized early.
cleanup_async_copy() will reference these fields if an error occurs
in nfsd4_copy(). If they are not correctly initialized, at the very
least, a refcount underflow occurs.
Reported-by: Olga Kornievskaia <okorniev@redhat.com>
Fixes: aadc3bbea163 ("NFSD: Limit the number of concurrent async COPY operations")
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Tested-by: Olga Kornievskaia <okorniev@redhat.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/nfsd/nfs4proc.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index 5768b2ff1d1d..81a1e3bf06b9 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -1838,14 +1838,14 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, if (!async_copy) goto out_err; async_copy->cp_nn = nn; + INIT_LIST_HEAD(&async_copy->copies); + refcount_set(&async_copy->refcount, 1); /* Arbitrary cap on number of pending async copy operations */ if (atomic_inc_return(&nn->pending_async_copies) > (int)rqstp->rq_pool->sp_nrthreads) { atomic_dec(&nn->pending_async_copies); goto out_err; } - INIT_LIST_HEAD(&async_copy->copies); - refcount_set(&async_copy->refcount, 1); async_copy->cp_src = kmalloc(sizeof(*async_copy->cp_src), GFP_KERNEL); if (!async_copy->cp_src) goto out_err; |