From: Trond Myklebust trond.myklebust@hammerspace.com

mainline inclusion from mainline-v5.13-rc4 commit 56517ab958b7c11030e626250c00b9b1a24b41eb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BHTI CVE: CVE-2021-47167

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...

--------------------------------

Ensure that nfs_pageio_error_cleanup() resets the mirror array contents, so that the structure reflects the fact that it is now empty. Also change the test in nfs_pageio_do_add_request() to be more robust by checking whether or not the list is empty rather than relying on the value of pg_count.

Fixes: a7d42ddb3099 ("nfs: add mirroring support to pgio layer") Signed-off-by: Trond Myklebust trond.myklebust@hammerspace.com Conflicts: fs/nfs/pagelist.c Signed-off-by: ZhaoLong Wang wangzhaolong1@huawei.com --- fs/nfs/pagelist.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c index a9e1bcdd9394..c5f862834b16 100644 --- a/fs/nfs/pagelist.c +++ b/fs/nfs/pagelist.c @@ -964,15 +964,17 @@ static int nfs_pageio_do_add_request(struct nfs_pageio_descriptor *desc,

struct nfs_page *prev = NULL;

- if (mirror->pg_count != 0) { - prev = nfs_list_entry(mirror->pg_list.prev); - } else { + if (list_empty(&mirror->pg_list)) { if (desc->pg_ops->pg_init) desc->pg_ops->pg_init(desc, req); if (desc->pg_error < 0) return 0; mirror->pg_base = req->wb_pgbase; - } + mirror->pg_count = 0; + mirror->pg_recoalesce = 0; + } else + prev = nfs_list_entry(mirror->pg_list.prev); + if (!nfs_can_coalesce_requests(prev, req, desc)) return 0; nfs_list_move_request(req, &mirror->pg_list);