diff options
| author | Fedor Pchelkin <pchelkin@ispras.ru> | 2023-07-25 14:58:58 +0300 |
|---|---|---|
| committer | Trond Myklebust <trond.myklebust@hammerspace.com> | 2023-08-19 10:26:29 -0400 |
| commit | 4e3733fd2b0f677faae21cf838a43faf317986d3 (patch) | |
| tree | cff0af28313860eec8604d3b2027bc02e8e12581 /fs/nfs | |
| parent | c3dd7de2a3137d84161dcfb522c19f8b2884e502 (diff) | |
| download | linux-4e3733fd2b0f677faae21cf838a43faf317986d3.tar.gz | |
NFSv4.2: fix error handling in nfs42_proc_getxattr
There is a slight issue with error handling code inside
nfs42_proc_getxattr(). If page allocating loop fails then we free the
failing page array element which is NULL but __free_page() can't deal with
NULL args.
Found by Linux Verification Center (linuxtesting.org).
Fixes: a1f26739ccdc ("NFSv4.2: improve page handling for GETXATTR")
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Diffstat (limited to 'fs/nfs')
| -rw-r--r-- | fs/nfs/nfs42proc.c | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c index 63802d1955566..49f78e23b34c0 100644 --- a/fs/nfs/nfs42proc.c +++ b/fs/nfs/nfs42proc.c @@ -1377,7 +1377,6 @@ ssize_t nfs42_proc_getxattr(struct inode *inode, const char *name, for (i = 0; i < np; i++) { pages[i] = alloc_page(GFP_KERNEL); if (!pages[i]) { - np = i + 1; err = -ENOMEM; goto out; } @@ -1401,8 +1400,8 @@ ssize_t nfs42_proc_getxattr(struct inode *inode, const char *name, } while (exception.retry); out: - while (--np >= 0) - __free_page(pages[np]); + while (--i >= 0) + __free_page(pages[i]); kfree(pages); return err; |