Re: Patch "NFSD fixing possible null pointer derefering in copy offload" has been added to the 5.5-stable tree

Re: Patch "NFSD fixing possible null pointer derefering in copy offload" has been added to the 5.5-stable tree

[Greg KH]

On Fri, Mar 13, 2020 at 08:35:22PM -0400, Sasha Levin wrote:
> This is a note to let you know that I've just added the patch titled
> 
>     NFSD fixing possible null pointer derefering in copy offload
> 
> to the 5.5-stable tree which can be found at:
>     http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
> 
> The filename of the patch is:
>      nfsd-fixing-possible-null-pointer-derefering-in-copy.patch
> and it can be found in the queue-5.5 subdirectory.
> 
> If you, or anyone else, feels it should not be added to the stable tree,
> please let <stable@vger.kernel.org> know about it.
> 
> 
> 
> commit a264e7b209f248f59b4fee0d1ed3fbde014a942e
> Author: Olga Kornievskaia <olga.kornievskaia@gmail.com>
> Date:   Wed Dec 4 15:13:54 2019 -0500
> 
>     NFSD fixing possible null pointer derefering in copy offload
>     
>     [ Upstream commit 2e577f0faca4640348c398cb85d60a1eedac4b1e ]
>     
>     Static checker revealed possible error path leading to possible
>     NULL pointer dereferencing.
>     
>     Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
>     Fixes: e0639dc5805a: ("NFSD introduce async copy feature")
>     Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
>     Signed-off-by: J. Bruce Fields <bfields@redhat.com>
>     Signed-off-by: Sasha Levin <sashal@kernel.org>
> 
> diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
> index 4798667af647c..91b64c15556e6 100644
> --- a/fs/nfsd/nfs4proc.c
> +++ b/fs/nfsd/nfs4proc.c
> @@ -1223,7 +1223,8 @@ static void cleanup_async_copy(struct nfsd4_copy *copy)
>  {
>  	nfs4_free_cp_state(copy);
>  	nfsd_file_put(copy->nf_dst);
> -	nfsd_file_put(copy->nf_src);
> +	if (copy->cp_intra)
> +		nfsd_file_put(copy->nf_src);
>  	spin_lock(&copy->cp_clp->async_lock);
>  	list_del(&copy->copies);
>  	spin_unlock(&copy->cp_clp->async_lock);

This breaks the build here, and in 5.4, so I'll go drop it from both
trees :(

thanks,

greg k-h

Re: Patch "NFSD fixing possible null pointer derefering in copy offload" has been added to the 5.5-stable tree

[Greg KH]

On Fri, Mar 13, 2020 at 08:35:22PM -0400, Sasha Levin wrote:
> This is a note to let you know that I've just added the patch titled
> 
>     NFSD fixing possible null pointer derefering in copy offload
> 
> to the 5.5-stable tree which can be found at:
>     http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
> 
> The filename of the patch is:
>      nfsd-fixing-possible-null-pointer-derefering-in-copy.patch
> and it can be found in the queue-5.5 subdirectory.
> 
> If you, or anyone else, feels it should not be added to the stable tree,
> please let <stable@vger.kernel.org> know about it.
> 
> 
> 
> commit a264e7b209f248f59b4fee0d1ed3fbde014a942e
> Author: Olga Kornievskaia <olga.kornievskaia@gmail.com>
> Date:   Wed Dec 4 15:13:54 2019 -0500
> 
>     NFSD fixing possible null pointer derefering in copy offload
>     
>     [ Upstream commit 2e577f0faca4640348c398cb85d60a1eedac4b1e ]
>     
>     Static checker revealed possible error path leading to possible
>     NULL pointer dereferencing.
>     
>     Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
>     Fixes: e0639dc5805a: ("NFSD introduce async copy feature")
>     Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
>     Signed-off-by: J. Bruce Fields <bfields@redhat.com>
>     Signed-off-by: Sasha Levin <sashal@kernel.org>
> 
> diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
> index 4798667af647c..91b64c15556e6 100644
> --- a/fs/nfsd/nfs4proc.c
> +++ b/fs/nfsd/nfs4proc.c
> @@ -1223,7 +1223,8 @@ static void cleanup_async_copy(struct nfsd4_copy *copy)
>  {
>  	nfs4_free_cp_state(copy);
>  	nfsd_file_put(copy->nf_dst);
> -	nfsd_file_put(copy->nf_src);
> +	if (copy->cp_intra)
> +		nfsd_file_put(copy->nf_src);

And shouldn't this patch just be:
	if (copy->nf_src)
instead?