Commit 7e6a72e5 authored by Christoph Hellwig's avatar Christoph Hellwig Committed by J. Bruce Fields

nfsd: fix file access refcount leak when nfsd4_truncate fails

nfsd4_process_open2 will currently will get access to the file, and then
call nfsd4_truncate to (possibly) truncate it. If that operation fails
though, then the access references will never be released as the
nfs4_ol_stateid is never initialized.

Fix by moving the nfsd4_truncate call into nfs4_get_vfs_file, ensuring
that the refcounts are properly put if the truncate fails.
Signed-off-by: default avatarJeff Layton <jlayton@primarydata.com>
Signed-off-by: default avatarChristoph Hellwig <hch@infradead.org>
Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
parent 1055414f
......@@ -3046,6 +3046,21 @@ static inline int nfs4_access_to_access(u32 nfs4_access)
return flags;
}
static inline __be32
nfsd4_truncate(struct svc_rqst *rqstp, struct svc_fh *fh,
struct nfsd4_open *open)
{
struct iattr iattr = {
.ia_valid = ATTR_SIZE,
.ia_size = 0,
};
if (!open->op_truncate)
return 0;
if (!(open->op_share_access & NFS4_SHARE_ACCESS_WRITE))
return nfserr_inval;
return nfsd_setattr(rqstp, fh, &iattr, 0, (time_t)0);
}
static __be32 nfs4_get_vfs_file(struct svc_rqst *rqstp, struct nfs4_file *fp,
struct svc_fh *cur_fh, struct nfsd4_open *open)
{
......@@ -3057,53 +3072,39 @@ static __be32 nfs4_get_vfs_file(struct svc_rqst *rqstp, struct nfs4_file *fp,
status = nfsd_open(rqstp, cur_fh, S_IFREG, access,
&fp->fi_fds[oflag]);
if (status)
return status;
goto out;
}
nfs4_file_get_access(fp, oflag);
status = nfsd4_truncate(rqstp, cur_fh, open);
if (status)
goto out_put_access;
return nfs_ok;
}
static inline __be32
nfsd4_truncate(struct svc_rqst *rqstp, struct svc_fh *fh,
struct nfsd4_open *open)
{
struct iattr iattr = {
.ia_valid = ATTR_SIZE,
.ia_size = 0,
};
if (!open->op_truncate)
return 0;
if (!(open->op_share_access & NFS4_SHARE_ACCESS_WRITE))
return nfserr_inval;
return nfsd_setattr(rqstp, fh, &iattr, 0, (time_t)0);
out_put_access:
nfs4_file_put_access(fp, oflag);
out:
return status;
}
static __be32
nfs4_upgrade_open(struct svc_rqst *rqstp, struct nfs4_file *fp, struct svc_fh *cur_fh, struct nfs4_ol_stateid *stp, struct nfsd4_open *open)
{
u32 op_share_access = open->op_share_access;
bool new_access;
__be32 status;
new_access = !test_access(op_share_access, stp);
if (new_access) {
if (!test_access(op_share_access, stp))
status = nfs4_get_vfs_file(rqstp, fp, cur_fh, open);
if (status)
return status;
}
else
status = nfsd4_truncate(rqstp, cur_fh, open);
if (status) {
if (new_access) {
int oflag = nfs4_access_to_omode(op_share_access);
nfs4_file_put_access(fp, oflag);
}
if (status)
return status;
}
/* remember the open */
set_access(op_share_access, stp);
set_deny(open->op_share_deny, stp);
return nfs_ok;
}
......@@ -3352,9 +3353,6 @@ nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nf
goto out;
} else {
status = nfs4_get_vfs_file(rqstp, fp, current_fh, open);
if (status)
goto out;
status = nfsd4_truncate(rqstp, current_fh, open);
if (status)
goto out;
stp = open->op_stp;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment