From: Chuck Lever chuck.lever@oracle.com
mainline inclusion from mainline-v6.12-rc6 commit 8286f8b622990194207df9ab852e0f87c60d35e9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5KQU CVE: CVE-2024-53073
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=...
----------------------------------------------------------------------
The error flow in nfsd4_copy() calls cleanup_async_copy(), which already decrements nn->pending_async_copies.
Reported-by: Olga Kornievskaia okorniev@redhat.com Fixes: aadc3bbea163 ("NFSD: Limit the number of concurrent async COPY operations") Signed-off-by: Chuck Lever chuck.lever@oracle.com
Conflicts: fs/nfsd/nfs4proc.c [Commit 87689df69491("NFSD: Shrink size of struct nfsd4_copy") add the allocation of cp_src.] Signed-off-by: Li Lingfeng lilingfeng3@huawei.com --- fs/nfsd/nfs4proc.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index 0c209443f9be..96c4e2616b51 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -1532,10 +1532,8 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, refcount_set(&async_copy->refcount, 1); /* Arbitrary cap on number of pending async copy operations */ if (atomic_inc_return(&nn->pending_async_copies) > - (int)rqstp->rq_pool->sp_nrthreads) { - atomic_dec(&nn->pending_async_copies); + (int)rqstp->rq_pool->sp_nrthreads) goto out_err; - } if (!nfs4_init_copy_state(nn, copy)) goto out_err; memcpy(©->cp_res.cb_stateid, ©->cp_stateid.stid,