From: Fedor Pchelkin <pchelkin@ispras.ru>
Date: Tue, 25 Jul 2023 11:58:58 +0000 (+0300)
Subject: NFSv4.2: fix error handling in nfs42_proc_getxattr
X-Git-Tag: v6.1.52~166
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=4a289d123f62f7fdf33e7ce02c4c4c0d3b708a2b;p=platform%2Fkernel%2Flinux-starfive.git

NFSv4.2: fix error handling in nfs42_proc_getxattr

[ Upstream commit 4e3733fd2b0f677faae21cf838a43faf317986d3 ]

There is a slight issue with error handling code inside
nfs42_proc_getxattr(). If page allocating loop fails then we free the
failing page array element which is NULL but __free_page() can't deal with
NULL args.

Found by Linux Verification Center (linuxtesting.org).

Fixes: a1f26739ccdc ("NFSv4.2: improve page handling for GETXATTR")
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c
index ecb4285..7c33bba 100644
--- a/fs/nfs/nfs42proc.c
+++ b/fs/nfs/nfs42proc.c
@@ -1359,7 +1359,6 @@ ssize_t nfs42_proc_getxattr(struct inode *inode, const char *name,
 	for (i = 0; i < np; i++) {
 		pages[i] = alloc_page(GFP_KERNEL);
 		if (!pages[i]) {
-			np = i + 1;
 			err = -ENOMEM;
 			goto out;
 		}
@@ -1383,8 +1382,8 @@ ssize_t nfs42_proc_getxattr(struct inode *inode, const char *name,
 	} while (exception.retry);
 
 out:
-	while (--np >= 0)
-		__free_page(pages[np]);
+	while (--i >= 0)
+		__free_page(pages[i]);
 	kfree(pages);
 
 	return err;