diff options
| author |   Olga Kornievskaia <kolga@netapp.com> | 2022-08-18 15:07:05 -0400 |
|---|---|---|
| committer |   Trond Myklebust <trond.myklebust@hammerspace.com> | 2022-08-19 20:31:57 -0400 |
| commit | fcfc8be1e9cf2f12b50dce8b579b3ae54443a014 (patch) | |
| tree | 4d6727dc998df8275be0cfe340bafa8c6b40731c /fs/nfs | |
| parent | NFS: unlink/rmdir shouldn't call d_delete() twice on ENOENT (diff) | |
| download | linux-dev-fcfc8be1e9cf2f12b50dce8b579b3ae54443a014.tar.xz linux-dev-fcfc8be1e9cf2f12b50dce8b579b3ae54443a014.zip | |
NFSv4.2 fix problems with __nfs42_ssc_open
A destination server while doing a COPY shouldn't accept using the
passed in filehandle if its not a regular filehandle.
If alloc_file_pseudo() has failed, we need to decrement a reference
on the newly created inode, otherwise it leaks.
Reported-by: Al Viro <viro@zeniv.linux.org.uk>
Fixes: ec4b092508982 ("NFS: inter ssc open")
Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Diffstat (limited to 'fs/nfs')
| -rw-r--r-- | fs/nfs/nfs4file.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c index e88f6b18445e..9eb181287879 100644 --- a/fs/nfs/nfs4file.c +++ b/fs/nfs/nfs4file.c @@ -340,6 +340,11 @@ static struct file *__nfs42_ssc_open(struct vfsmount *ss_mnt, goto out; } + if (!S_ISREG(fattr->mode)) { + res = ERR_PTR(-EBADF); + goto out; + } + res = ERR_PTR(-ENOMEM); len = strlen(SSC_READ_NAME_BODY) + 16; read_name = kzalloc(len, GFP_KERNEL); @@ -357,6 +362,7 @@ static struct file *__nfs42_ssc_open(struct vfsmount *ss_mnt, r_ino->i_fop); if (IS_ERR(filep)) { res = ERR_CAST(filep); + iput(r_ino); goto out_free_name; } |