Commit 63fab04c authored by Chuck Lever's avatar Chuck Lever
Browse files

NFSD: Initialize struct nfsd4_copy earlier 



Ensure the refcount and async_copies fields are initialized early.
cleanup_async_copy() will reference these fields if an error occurs
in nfsd4_copy(). If they are not correctly initialized, at the very
least, a refcount underflow occurs.

Reported-by: default avatarOlga Kornievskaia <okorniev@redhat.com>
Fixes: aadc3bbe ("NFSD: Limit the number of concurrent async COPY operations")
Reviewed-by: default avatarJeff Layton <jlayton@kernel.org>
Tested-by: default avatarOlga Kornievskaia <okorniev@redhat.com>
Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
parent d5ff2fb2

fs/nfsd/nfs4proc.c

+2 −2
Original line number Diff line number Diff line
@@ -1841,14 +1841,14 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, 
		if (!async_copy)

			goto out_err;

		async_copy->cp_nn = nn;

		INIT_LIST_HEAD(&async_copy->copies);

		refcount_set(&async_copy->refcount, 1);

		/* Arbitrary cap on number of pending async copy operations */

		if (atomic_inc_return(&nn->pending_async_copies) >

				(int)rqstp->rq_pool->sp_nrthreads) {

			atomic_dec(&nn->pending_async_copies);

			goto out_err;

		}

		INIT_LIST_HEAD(&async_copy->copies);

		refcount_set(&async_copy->refcount, 1);

		async_copy->cp_src = kmalloc(sizeof(*async_copy->cp_src), GFP_KERNEL);

		if (!async_copy->cp_src)

			goto out_err;