[Devel] [PATCH VZ10] fs/fuse kio: fix use of uninitialized data chunk counter on error path

[Liu Kui]

In kreq_make_sendmsg(), the data chunk counter nr_data_chunks is reset
only after the header chunk has been set up. If mapping the header chunk
fails, the error path calls kreq_release_data_chunks() with an uninitialized
counter value, so it walks garbage chunk entries, triggering the "Invalid
chunk type" warning and potentially freeing the wrong memory .

Fix this by resetting the counter before the first error exit.

https://virtuozzo.atlassian.net/browse/VSTOR-143521

Signed-off-by: Liu Kui <kui.liu at virtuozzo.com>
---
 fs/fuse/kio/pcs/pcs_krpc.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/fs/fuse/kio/pcs/pcs_krpc.c b/fs/fuse/kio/pcs/pcs_krpc.c
index 0930fb4adf12..fc7bddf6bb97 100644
--- a/fs/fuse/kio/pcs/pcs_krpc.c
+++ b/fs/fuse/kio/pcs/pcs_krpc.c
@@ -499,6 +499,10 @@ static int kreq_make_sendmsg(struct krpc_req *kreq)
 		kreq->data_chunks = &kreq->inline_data_chunks[0];
 	}
 
+	kreq->data_len = 0;
+	kreq->nr_data_chunks = 0;
+	kreq->nr_data_bvecs = 0;
+
 	/*
 	 * Header buff is exactly one page, used for staging message header. Will be used for
 	 * receiving header of response message as well.
@@ -523,9 +527,6 @@ static int kreq_make_sendmsg(struct krpc_req *kreq)
 	kreq->hdr_kv.iov_len = chunk->len;
 
 	/* data chunk buf descriptors are placed at end of header buf, grow backwards */
-	kreq->data_len = 0;
-	kreq->nr_data_chunks = 0;
-	kreq->nr_data_bvecs = 0;
 
 	chunk_bd = (struct pcs_krpc_buf_desc *)(kreq->hdr_buf + PAGE_SIZE) - 1;
 	chunk = kreq->data_chunks;
-- 
2.50.1 (Apple Git-155)