| Message ID | 20240930090115.463284-1-zhangyanjun@cestc.cn (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | [v3] NFSv4: fix possible NULL-pointer dereference in nfs42_complete_copies() | expand |
> On the node of an nfs client, some files saved in the mountpoint of the > nfs server were coping within the same nfs server. Accidentally, the > nfs42_complete_copies() get a NULL-pointer dereference crash, as can be > seen in following syslog: … > Fixes: 0e65a32c8a56 ("NFS: handle source server reboot") > Signed-off-by: Yanjun Zhang <zhangyanjun@cestc.cn> > --- > fs/nfs/client.c | 1 + … Thanks for your patch adjustment. Would you like to present any version descriptions accordingly? https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.11#n310 Regards, Markus
> On the node of an nfs client, some files saved in the mountpoint of the NFS? > nfs server were coping within the same nfs server. Accidentally, the copying data? > nfs42_complete_copies() get … Would any further adjustments become helpful for this patch? Regards, Markus
diff --git a/fs/nfs/client.c b/fs/nfs/client.c index 8286edd60..c49d5cce5 100644 --- a/fs/nfs/client.c +++ b/fs/nfs/client.c @@ -983,6 +983,7 @@ struct nfs_server *nfs_alloc_server(void) INIT_LIST_HEAD(&server->layouts); INIT_LIST_HEAD(&server->state_owners_lru); INIT_LIST_HEAD(&server->ss_copies); + INIT_LIST_HEAD(&server->ss_src_copies); atomic_set(&server->active, 0); diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c index 28704f924..531c9c20e 100644 --- a/fs/nfs/nfs42proc.c +++ b/fs/nfs/nfs42proc.c @@ -218,7 +218,7 @@ static int handle_async_copy(struct nfs42_copy_res *res, if (dst_server != src_server) { spin_lock(&src_server->nfs_client->cl_lock); - list_add_tail(©->src_copies, &src_server->ss_copies); + list_add_tail(©->src_copies, &src_server->ss_src_copies); spin_unlock(&src_server->nfs_client->cl_lock); } diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c index 877f682b4..00516982b 100644 --- a/fs/nfs/nfs4state.c +++ b/fs/nfs/nfs4state.c @@ -1596,7 +1596,7 @@ static void nfs42_complete_copies(struct nfs4_state_owner *sp, struct nfs4_state complete(©->completion); } } - list_for_each_entry(copy, &sp->so_server->ss_copies, src_copies) { + list_for_each_entry(copy, &sp->so_server->ss_src_copies, src_copies) { if ((test_bit(NFS_CLNT_SRC_SSC_COPY_STATE, &state->flags) && !nfs4_stateid_match_other(&state->stateid, ©->parent_src_state->stateid))) diff --git a/include/linux/nfs_fs_sb.h b/include/linux/nfs_fs_sb.h index 1df86ab98..793a4a610 100644 --- a/include/linux/nfs_fs_sb.h +++ b/include/linux/nfs_fs_sb.h @@ -240,6 +240,7 @@ struct nfs_server { struct list_head layouts; struct list_head delegations; struct list_head ss_copies; + struct list_head ss_src_copies; unsigned long delegation_gen; unsigned long mig_gen;