From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CF068C83F1C for ; Mon, 28 Aug 2023 10:44:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231834AbjH1Knn (ORCPT ); Mon, 28 Aug 2023 06:43:43 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58540 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231980AbjH1Knh (ORCPT ); Mon, 28 Aug 2023 06:43:37 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A1DF3CDB for ; Mon, 28 Aug 2023 03:43:12 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6E30063F70 for ; Mon, 28 Aug 2023 10:43:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7F0F1C433C8; Mon, 28 Aug 2023 10:43:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1693219384; bh=PDegLrzsfscu8XXLs/FlIPDtVZsan2hk6slzFJuursI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uMeHNoCZ8RA/0wMsSoDgNnCFiLXjOcC+y0fXTMU4CwBMz8sk0vrYC3c/t23TqH8KT yoSHx0cDKqkPHe0wCgwyPKRF9IFxS0TQRcZizAXnEFkYh3g1oZkXH4bwCKToHOprrw MCsA8Ulvo9So+a/miQOyWeol3FHoln48BZaIpu5s= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Fedor Pchelkin , Benjamin Coddington , Trond Myklebust , Sasha Levin Subject: [PATCH 5.15 03/89] NFSv4: fix out path in __nfs4_get_acl_uncached Date: Mon, 28 Aug 2023 12:13:04 +0200 Message-ID: <20230828101150.293055388@linuxfoundation.org> X-Mailer: git-send-email 2.42.0 In-Reply-To: <20230828101150.163430842@linuxfoundation.org> References: <20230828101150.163430842@linuxfoundation.org> User-Agent: quilt/0.67 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org 5.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Fedor Pchelkin [ Upstream commit f4e89f1a6dab4c063fc1e823cc9dddc408ff40cf ] Another highly rare error case when a page allocating loop (inside __nfs4_get_acl_uncached, this time) is not properly unwound on error. Since pages array is allocated being uninitialized, need to free only lower array indices. NULL checks were useful before commit 62a1573fcf84 ("NFSv4 fix acl retrieval over krb5i/krb5p mounts") when the array had been initialized to zero on stack. Found by Linux Verification Center (linuxtesting.org). Fixes: 62a1573fcf84 ("NFSv4 fix acl retrieval over krb5i/krb5p mounts") Signed-off-by: Fedor Pchelkin Reviewed-by: Benjamin Coddington Signed-off-by: Trond Myklebust Signed-off-by: Sasha Levin --- fs/nfs/nfs4proc.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c index b1ec9b5d06e58..31bf3e9dc7a56 100644 --- a/fs/nfs/nfs4proc.c +++ b/fs/nfs/nfs4proc.c @@ -5964,9 +5964,8 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu out_ok: ret = res.acl_len; out_free: - for (i = 0; i < npages; i++) - if (pages[i]) - __free_page(pages[i]); + while (--i >= 0) + __free_page(pages[i]); if (res.acl_scratch) __free_page(res.acl_scratch); kfree(pages); -- 2.40.1