diff options
| author | Trond Myklebust <trond.myklebust@hammerspace.com> | 2023-08-08 21:17:11 -0400 |
|---|---|---|
| committer | Trond Myklebust <trond.myklebust@hammerspace.com> | 2023-08-17 09:30:38 -0400 |
| commit | be2fd1560eb57b7298aa3c258ddcca0d53ecdea3 (patch) | |
| tree | a02cf921b85b528487e1163f1f80f27b1584cfda /fs/nfs | |
| parent | 1cbc11aaa01f80577b67ae02c73ee781112125fd (diff) | |
| download | linux-be2fd1560eb57b7298aa3c258ddcca0d53ecdea3.tar.gz | |
NFS: Fix a use after free in nfs_direct_join_group()
Be more careful when tearing down the subrequests of an O_DIRECT write
as part of a retransmission.
Reported-by: Chris Mason <clm@fb.com>
Fixes: ed5d588fe47f ("NFS: Try to join page groups before an O_DIRECT retransmission")
Cc: stable@vger.kernel.org
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Diffstat (limited to 'fs/nfs')
| -rw-r--r-- | fs/nfs/direct.c | 26 |
1 files changed, 16 insertions, 10 deletions
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c index 9a18c5a69ace6..aaffaaa336cc5 100644 --- a/fs/nfs/direct.c +++ b/fs/nfs/direct.c @@ -472,20 +472,26 @@ out: return result; } -static void -nfs_direct_join_group(struct list_head *list, struct inode *inode) +static void nfs_direct_join_group(struct list_head *list, struct inode *inode) { - struct nfs_page *req, *next; + struct nfs_page *req, *subreq; list_for_each_entry(req, list, wb_list) { - if (req->wb_head != req || req->wb_this_page == req) + if (req->wb_head != req) continue; - for (next = req->wb_this_page; - next != req->wb_head; - next = next->wb_this_page) { - nfs_list_remove_request(next); - nfs_release_request(next); - } + subreq = req->wb_this_page; + if (subreq == req) + continue; + do { + /* + * Remove subrequests from this list before freeing + * them in the call to nfs_join_page_group(). + */ + if (!list_empty(&subreq->wb_list)) { + nfs_list_remove_request(subreq); + nfs_release_request(subreq); + } + } while ((subreq = subreq->wb_this_page) != req); nfs_join_page_group(req, inode); } } |