NFSD: Put file after ima_file_check fail in nfsd_open()

Signed-off-by: Kinglong Mee <kinglongmee@gmail.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>

diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index f501a9b5c9df18f5ec7cc360d385aa0c9dfb8344..89d1ae3bcff73a4a0823fa0599a552c4eeadc566 100644 (file)
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -649,6 +649,7 @@ nfsd_open(struct svc_rqst *rqstp, struct svc_fh *fhp, umode_t type,
 {
        struct path     path;
        struct inode    *inode;
 {
        struct path     path;
        struct inode    *inode;

+       struct file     *file;

        int             flags = O_RDONLY|O_LARGEFILE;
        __be32          err;
        int             host_err = 0;
        int             flags = O_RDONLY|O_LARGEFILE;
        __be32          err;
        int             host_err = 0;


@@ -703,19 +704,25 @@ nfsd_open(struct svc_rqst *rqstp, struct svc_fh *fhp, umode_t type,
                else
                        flags = O_WRONLY|O_LARGEFILE;
        }
                else
                        flags = O_WRONLY|O_LARGEFILE;
        }

-       *filp = dentry_open(&path, flags, current_cred());
-       if (IS_ERR(*filp)) {
-               host_err = PTR_ERR(*filp);
-               *filp = NULL;
-       } else {
-               host_err = ima_file_check(*filp, may_flags);

 
 

-               if (may_flags & NFSD_MAY_64BIT_COOKIE)
-                       (*filp)->f_mode |= FMODE_64BITHASH;
-               else
-                       (*filp)->f_mode |= FMODE_32BITHASH;
+       file = dentry_open(&path, flags, current_cred());
+       if (IS_ERR(file)) {
+               host_err = PTR_ERR(file);
+               goto out_nfserr;

        }
 
        }
 

+       host_err = ima_file_check(file, may_flags);
+       if (host_err) {
+               nfsd_close(file);
+               goto out_nfserr;
+       }
+
+       if (may_flags & NFSD_MAY_64BIT_COOKIE)
+               file->f_mode |= FMODE_64BITHASH;
+       else
+               file->f_mode |= FMODE_32BITHASH;
+
+       *filp = file;

 out_nfserr:
        err = nfserrno(host_err);
 out:
 out_nfserr:
        err = nfserrno(host_err);
 out: