From: Jeff Layton <jlayton@kernel.org>

Date: Tue, 17 Jan 2023 14:38:30 -0500

Subject: [PATCH] nfsd: zero out pointers after putting nfsd_files on COPY

 setup error

References: bsc#1012628

Patch-mainline: 6.2.3

Git-commit: 1f0001d43d0c0ac2a19a34a914f6595ad97cbc1d

[ Upstream commit 1f0001d43d0c0ac2a19a34a914f6595ad97cbc1d ]

At first, I thought this might be a source of nfsd_file overputs, but

the current callers seem to avoid an extra put when nfsd4_verify_copy

returns an error.

Still, it's "bad form" to leave the pointers filled out when we don't

have a reference to them anymore, and that might lead to bugs later.

Zero them out as a defensive coding measure.

Signed-off-by: Jeff Layton <jlayton@kernel.org>

Signed-off-by: Chuck Lever <chuck.lever@oracle.com>

Signed-off-by: Sasha Levin <sashal@kernel.org>

Signed-off-by: Jiri Slaby <jslaby@suse.cz>

---

 fs/nfsd/nfs4proc.c | 2 ++

 1 file changed, 2 insertions(+)

diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c

index 92674077..e02ff76f 100644

--- a/fs/nfsd/nfs4proc.c

+++ b/fs/nfsd/nfs4proc.c

@@ -1214,8 +1214,10 @@ nfsd4_verify_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,

 	return status;

 out_put_dst:

 	nfsd_file_put(*dst);

+	*dst = NULL;

 out_put_src:

 	nfsd_file_put(*src);

+	*src = NULL;

 	goto out;

 }

-- 

2.35.3