Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 301f0268 authored by Al Viro's avatar Al Viro
Browse files

nfsd: racy access to ->d_name in nsfd4_encode_path() 



Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent ca4e0519

fs/nfsd/nfs4xdr.c

+8 −6
Original line number Diff line number Diff line
@@ -1816,10 +1816,7 @@ static __be32 nfsd4_encode_fs_location4(struct nfsd4_fs_location *location, 
static __be32 nfsd4_encode_path(const struct path *root,

		const struct path *path, __be32 **pp, int *buflen)

{

	struct path cur = {

		.mnt = path->mnt,

		.dentry = path->dentry,

	};

	struct path cur = *path;

	__be32 *p = *pp;

	struct dentry **components = NULL;

	unsigned int ncomponents = 0;
@@ -1859,14 +1856,19 @@ static __be32 nfsd4_encode_path(const struct path *root, 


	while (ncomponents) {

		struct dentry *dentry = components[ncomponents - 1];

		unsigned int len = dentry->d_name.len;

		unsigned int len;



		spin_lock(&dentry->d_lock);

		len = dentry->d_name.len;

		*buflen -= 4 + (XDR_QUADLEN(len) << 2);

		if (*buflen < 0)

		if (*buflen < 0) {

			spin_unlock(&dentry->d_lock);

			goto out_free;

		}

		WRITE32(len);

		WRITEMEM(dentry->d_name.name, len);

		dprintk("/%s", dentry->d_name.name);

		spin_unlock(&dentry->d_lock);

		dput(dentry);

		ncomponents--;

	}