Commit dd862da6 authored by NeilBrown's avatar NeilBrown Committed by Anna Schumaker
Browse files

nfs: fix incorrect handling of large-number NFS errors in nfs4_do_mkdir() 



A recent commit introduced nfs4_do_mkdir() which reports an error from
nfs4_call_sync() by returning it with ERR_PTR().

This is a problem as nfs4_call_sync() can return negative NFS-specific
errors with values larger than MAX_ERRNO (4095).  One example is
NFS4ERR_DELAY which has value 10008.

This "pointer" gets to PTR_ERR_OR_ZERO() in nfs4_proc_mkdir() which
chooses ZERO because it isn't in the range of value errors.  Ultimately
the pointer is dereferenced.

This patch changes nfs4_do_mkdir() to report the dentry pointer and
status separately - pointer as a return value, status in an "int *"
parameter.

The same separation is used for _nfs4_proc_mkdir() and the two are
combined only in nfs4_proc_mkdir() after the status has passed through
nfs4_handle_exception(), which ensures the error code does not exceed
MAX_ERRNO.

It also fixes a problem in the even when nfs4_handle_exception() updated
the error value, the original 'alias' was still returned.

Reported-by: default avatarAnna Schumaker <anna@kernel.org>
Fixes: 8376583b ("nfs: change mkdir inode_operation to return alternate dentry if needed.")
Signed-off-by: default avatarNeilBrown <neil@brown.name>
Signed-off-by: default avatarAnna Schumaker <anna.schumaker@oracle.com>
parent 80c4de6a

fs/nfs/nfs4proc.c

+20 −12
Original line number Diff line number Diff line
@@ -5164,13 +5164,15 @@ static int nfs4_do_create(struct inode *dir, struct dentry *dentry, struct nfs4_ 
}



static struct dentry *nfs4_do_mkdir(struct inode *dir, struct dentry *dentry,

				    struct nfs4_createdata *data)

				    struct nfs4_createdata *data, int *statusp)

{

	int status = nfs4_call_sync(NFS_SERVER(dir)->client, NFS_SERVER(dir), &data->msg,

	struct dentry *ret;



	*statusp = nfs4_call_sync(NFS_SERVER(dir)->client, NFS_SERVER(dir), &data->msg,

				    &data->arg.seq_args, &data->res.seq_res, 1);



	if (status)

		return ERR_PTR(status);

	if (*statusp)

		return NULL;



	spin_lock(&dir->i_lock);

	/* Creating a directory bumps nlink in the parent */
@@ -5179,7 +5181,11 @@ static struct dentry *nfs4_do_mkdir(struct inode *dir, struct dentry *dentry, 
				      data->res.fattr->time_start,

				      NFS_INO_INVALID_DATA);

	spin_unlock(&dir->i_lock);

	return nfs_add_or_obtain(dentry, data->res.fh, data->res.fattr);

	ret = nfs_add_or_obtain(dentry, data->res.fh, data->res.fattr);

	if (!IS_ERR(ret))

		return ret;

	*statusp = PTR_ERR(ret);

	return NULL;

}



static void nfs4_free_createdata(struct nfs4_createdata *data)
@@ -5240,17 +5246,18 @@ static int nfs4_proc_symlink(struct inode *dir, struct dentry *dentry, 


static struct dentry *_nfs4_proc_mkdir(struct inode *dir, struct dentry *dentry,

				       struct iattr *sattr,

				       struct nfs4_label *label)

				       struct nfs4_label *label, int *statusp)

{

	struct nfs4_createdata *data;

	struct dentry *ret = ERR_PTR(-ENOMEM);

	struct dentry *ret = NULL;



	*statusp = -ENOMEM;

	data = nfs4_alloc_createdata(dir, &dentry->d_name, sattr, NF4DIR);

	if (data == NULL)

		goto out;



	data->arg.label = label;

	ret = nfs4_do_mkdir(dir, dentry, data);

	ret = nfs4_do_mkdir(dir, dentry, data, statusp);



	nfs4_free_createdata(data);

out:
@@ -5273,11 +5280,12 @@ static struct dentry *nfs4_proc_mkdir(struct inode *dir, struct dentry *dentry, 
	if (!(server->attr_bitmask[2] & FATTR4_WORD2_MODE_UMASK))

		sattr->ia_mode &= ~current_umask();

	do {

		alias = _nfs4_proc_mkdir(dir, dentry, sattr, label);

		err = PTR_ERR_OR_ZERO(alias);

		alias = _nfs4_proc_mkdir(dir, dentry, sattr, label, &err);

		trace_nfs4_mkdir(dir, &dentry->d_name, err);

		err = nfs4_handle_exception(NFS_SERVER(dir), err,

				&exception);

		if (err)

			alias = ERR_PTR(nfs4_handle_exception(NFS_SERVER(dir),

							      err,

							      &exception));

	} while (exception.retry);

	nfs4_label_release_security(label);