From nobody Wed Jun 17 01:34:29 2026 Received: from SY5PR01CU010.outbound.protection.outlook.com (mail-australiaeastazon11022105.outbound.protection.outlook.com [40.107.40.105]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0B5C43B2FF9; Tue, 21 Apr 2026 10:03:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.40.105 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776765828; cv=fail; b=jYby2ChNbqO7Z64EXff8IVrZjqbDKNeHZq6JteeLGpbtSipQgxKs8Wz0Hp2aX2dgaZCuI8JqTvSkvcyncH3cY8ikJMARPYmh6fbdTaepx0UYSnNtHQUWwWmCg8yAWPcIGXumeFjYoYdmax0HESruRr4hbpTrsgjg/YMiVE6eA9Y= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776765828; c=relaxed/simple; bh=Rgsmkwa46BtvzLjNz7OU2IEQtfWYRzKKkiSsS6oMELs=; h=From:To:CC:Subject:Date:Message-ID:References:In-Reply-To: Content-Type:MIME-Version; b=eyHR1HgWwaU/BEbj4nKUdVq1lKAzr/W7be4qY3lF7bCXQSggXzcL+Fjckr9Y6bcMZ8l8T4xjHj/EKwjT+CU32zJDv8bnJ9O9WZxDSRFQsJhsVTLTH0oIzZwGlJLkMwUHjChEkgrN5BrILmeaMbR5Co00eZMXkqe0k/cnLAH2Umo= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=verivus.ai; spf=pass smtp.mailfrom=verivus.ai; dkim=fail (2048-bit key) header.d=verivus.ai header.i=@verivus.ai header.b=kjmp8Jvl reason="signature verification failed"; arc=fail smtp.client-ip=40.107.40.105 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=verivus.ai Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=verivus.ai Authentication-Results: smtp.subspace.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=verivus.ai header.i=@verivus.ai header.b="kjmp8Jvl" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=zOYUIirynE+wE6dFa2B6sKhGfIdntaQr+pWhSCGnWFssgLYlZVuNLpHX3d/P8A00Dveohnp+pl1/Qb843Rfv5kvmsTF0yiQYXdkal2LI4xE9j/V37flwcSnY36HnV6PlDp+t1rZ6Vny32r/3zn2N0Wh8mYoc2lHzZZWgmvGPFut+NL+B7sE28w4CbenKUtfReeX8OP2TxVC0J57GAx8XsAXMzcp8jwrWpHF4Ll7kT/Q8oTsByMuyWCATrLAUI+5P9JIJFnbF6FRjVDdMk3DCWxRbN2tM1bSu8ZyULpzLL3aBlsE7pjOs6Z4gDCHFRvqqNLV3VxlBk0FYxywfbzrT1A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=2RGGI4074a87aPkSnQfXUa8gWHaRbOzK3JMHfm3j278=; b=JHySsLz2c+rrK/N3JvCJ5aFG690Co8VK/HhluOxMdqW7TdzJL2ULoTmslQWaea4kKnAVM3kI+NgH/aZWpSiKqLNruYa/l6PES/SBI0Wk25yi1RXemjI8cfVDfjjWY3jZ1Yp2Pdx051a+MuXciM5DUeO4mcHuwY6UZHzPN/idMbHMapnLaj3TFe5PYVQGPIjOrpgGSSF7YZUxsTWJHbTcBFfGL89w7pz3i6VroJxzSKR2PmHTopSCn4GwnSAE+BxJKjiifI7rJmdn4DrVQxK3LuXbOZUjriiY1s/J3Hbmp2L3+z2I58XlRp1z6m49OFQ+9VwUy7RSfhypyCXpGV7IRw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=verivus.ai; dmarc=pass action=none header.from=verivus.ai; dkim=pass header.d=verivus.ai; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=verivus.ai; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=2RGGI4074a87aPkSnQfXUa8gWHaRbOzK3JMHfm3j278=; b=kjmp8Jvlf6ipBkRiDY1sYcOuw8Vqf3PhWLfTwZbC7ZeROXoEbjG6jqwDakLDgy1EJ8wDFJcNeO86KN/4S9aYgqdHA28DproViVaYZwVvhm7qb16nqF8YySyErMHWPtkLtnIeksAip1oQAvNmzlZCQA3+lodNE9KdpcB74ecjvTdUq8CaVUphpMMNZQRGpni650ZNKVVybshzs4p8IfJJeKmL7mgMHsXUQL5/mlS4cio87RiVzBW5lVStzvQsvabEDFgVKj8Z69qQGJkcq1KPdRs3Hzj1kj1xGhKR37sdRCfCX85gYyh2hgFA1O6QsPPI8Pgg4IcrxbDw3bONTT9+qQ== Received: from ME0P300MB0853.AUSP300.PROD.OUTLOOK.COM (2603:10c6:220:22a::5) by SY9P300MB1529.AUSP300.PROD.OUTLOOK.COM (2603:10c6:10:2d6::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9846.16; Tue, 21 Apr 2026 10:03:42 +0000 Received: from ME0P300MB0853.AUSP300.PROD.OUTLOOK.COM ([fe80::1e3f:9cb9:4a95:b5a2]) by ME0P300MB0853.AUSP300.PROD.OUTLOOK.COM ([fe80::1e3f:9cb9:4a95:b5a2%5]) with mapi id 15.20.9846.017; Tue, 21 Apr 2026 10:03:42 +0000 From: Werner Kasselman To: Trond Myklebust , Anna Schumaker CC: Christoph Hellwig , "linux-nfs@vger.kernel.org" , "linux-kernel@vger.kernel.org" , "stable@vger.kernel.org" , Werner Kasselman Subject: [PATCH 1/2] pnfs/blocklayout: validate volume indices and limit recursion depth Thread-Topic: [PATCH 1/2] pnfs/blocklayout: validate volume indices and limit recursion depth Thread-Index: AQHc0XYiuLmD3qJpg0ifIwD9rIzO3Q== Date: Tue, 21 Apr 2026 10:03:42 +0000 Message-ID: <20260421100338.1227152-2-werner@verivus.com> References: <20260421100338.1227152-1-werner@verivus.com> In-Reply-To: <20260421100338.1227152-1-werner@verivus.com> Accept-Language: en-AU, en-AT, en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-mailer: git-send-email 2.43.0 authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=verivus.ai; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: ME0P300MB0853:EE_|SY9P300MB1529:EE_ x-ms-office365-filtering-correlation-id: a265329c-69fa-4255-78e8-08de9f8d44e9 x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|376014|366016|1800799024|38070700021|18002099003|22082099003|56012099003; x-microsoft-antispam-message-info: x8pgr4aCCvrBdBoFgJSkLXcknmy19hupp1GWyfBBV45F7udACirE+uUJ2LTxH8JRwSs8xIyStMOqEHA8ofeoG1SxFo5QDqNVhieR2uSFXYm6CgHpGM3Fj6D7047aZKypgmwrUw6wN0VvF7ikU8loGindmUso3BrgAsogOgrnIJYjpVivce5rDI9L41mf28INqxfUgRQxhxZpuQVsLQ6CqeP306fV/DPe9ng9KNX/ClRpql2b9FgAi+OAI8+aS84EE5FtiGaZ5ob+xqhbRamMiCZrW/gNcYLBkfbjLf5xO3sq1BUFMj+2WmqRw1Wcg7kVSJdTePq5X91JRUquG0Mb5OwVaIDruQObrgzKMIkoKXjp9PuXy7n/3ZyUyEUIVciqup1gssYbsby5A/rSKYByb1e4GbjiwGSE+QxiyxKzTr/oBlmjJwmMwSZwzlYeDr6ma0sW7Tri3jSDz0pX8eB3eHm9GVKpUJ7Hz7tqk+mmklocd9xBCuo2zL2b1PGnARrZYPer2LlsiudTeBzjT7mV5Gj+e+UBFhE7yiQN5lvIQkWXJsDObRy8q4V/BUQPlUkso2Nwh5x+jz1HktOdnU6mqnxJX22A6mX10H9au6gV2GecpzkEZuXYkXQTmEcd34/Ks4FI9OiKDgoP+0oH37hHhUCImYm733yXljoU5NXSt6nGbC2WOtxWzJIoBwtUM112vM3sGvAriT/nW33zCI0Bdh13s4A7squI+CPmh/W7845s+KQoQ/tEbyuvPeQsL51ehW8c+afkSE1n98kt/LEQVBY0+8oK7y719HFUGJ8C2bo= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:ME0P300MB0853.AUSP300.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(376014)(366016)(1800799024)(38070700021)(18002099003)(22082099003)(56012099003);DIR:OUT;SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?Z4rmUmemN58XBueFvgcRxcZ1RpS6vNPJGLig6LlgQJb1r17uYXsByi2atb?= =?iso-8859-1?Q?SBkjJsTnFmOfiBm+n6tp23N1vwM/RlK1qNkTjW+hP+k1+2gn4cwNKXqiD9?= =?iso-8859-1?Q?atF8iy/a0wSV3P4LcCLbs4338J9d03Uvq8GtFSngJlhfQhG6LmUzNRqSVv?= =?iso-8859-1?Q?J4Bnj8M9sUX26pe9N6I20KR0qYUTaJ8+vLAzdNMAKXfbeVBBV12HoCIONp?= =?iso-8859-1?Q?7SuVVmLIVKkLDz1tVvDcIFcp/awlNeJgsNQEpfu09XmdGbS4bIh/tvxc7t?= =?iso-8859-1?Q?JyDQpbK4KyPeCMDVG/He2NB+lXogGLn3XDLShFRd2g2MuAC463fHF9ljV4?= =?iso-8859-1?Q?fz71gRj2UWelVUMhBq3H2g/seTSZjUzuzrIt6oKt9mKVimuqI79h3GeLvA?= =?iso-8859-1?Q?WtOxO3kOTyIg5Ed1gHbpIRHyB+Y+EXVa6zVgr59/h6uSSlF2Km46kCNwgV?= =?iso-8859-1?Q?P727O5LWHYfIs/1RqFE//msP7CX6ZdwBmgBQatNkmKisMGK/DydhZEQP01?= =?iso-8859-1?Q?XDn/WAzBqfvDlSJb+FjB96ynD+rfiPdnI5v5KFAN17X7D8gG2pj6gOlcfF?= =?iso-8859-1?Q?5IJBpUEfd4oSrZ5TrTX+XMvO0YpQjqeSt21YixF0Jo07gfpWu7snyrPsbO?= =?iso-8859-1?Q?fabKlEDa3eMK3PE+lbEoVeIDuAGdMx3dCs8p4V/Y42eqwSDK3EYET6vDJI?= =?iso-8859-1?Q?RUhqNaTVvMjzHsnItxZiLeR1rZsdUaoiJesJsNmlGJFGcHxWBOpvmci+qf?= =?iso-8859-1?Q?kejs7j0kAZgz6HhS5XoofzKJvo9eoMpLTbDEbFmXkF6oflgOeA2xMLaMcs?= =?iso-8859-1?Q?0L63dgghz0mLVJd7mZ6FBO0Ae6RN4qvP7C4SEUCHzKYUgTCrfnptGCvmYB?= =?iso-8859-1?Q?t5fp79/aKxJUwTG12yXqy+sHakEdt9GxAXQF5JMdPpPuLVXIUNEl+bmWG9?= =?iso-8859-1?Q?v5oemT8M1Clf/vmHWlmJxFVHEvoYWi99UqMxCTTcHPiyvC+qNDCvTzF0PT?= =?iso-8859-1?Q?ZFqKaXpmtiiq2l1pD0k4tR0Yw8ZT8kA0N35Ok9yfZqRDUn2Xnd2nTxNj66?= =?iso-8859-1?Q?UVdyjvHKuX7lJFof2ahQsTT7uceuEyD0ztjrPWyycddbDXwqhSIfqyLGhU?= =?iso-8859-1?Q?9usFyKe98G7Qsn+SunAxraHS8BSjpeZ/yRvxGbt+zJokcvZXm6mmr7d8UM?= =?iso-8859-1?Q?QPOTuG2q/lNb8ODOBmZmlxcrf7WlWOELYme+hG1hcQpzkcFF8f7Yf3GHYB?= =?iso-8859-1?Q?edAxYUfyrZMMETZllys0j8LJTp1yK3jOb4m7MkNxZ1AivjrfoRWUuMRNB3?= =?iso-8859-1?Q?ZGvyiwQ8z25DdGTOO3PEFcQVigC82wkJB0s24LcJ65zY/iU7DkzVvm+3c7?= =?iso-8859-1?Q?cWlJgZCGZpdSSDSgb/mAiyMmJDgVS9nmLCcd5hOj/wUpASAvt8f3ykJ8SR?= =?iso-8859-1?Q?YsUwV7bVcvkVpjq/Z24ZB7eDVGPE6HAPe3saMdrpFJ/BBd+RaBROBV7o3F?= =?iso-8859-1?Q?Jg6NacS6Nx2nNX41LDx7Hko5dj7g+UrfYecWIAd+4cFZWFYrmTnZ+bNRY2?= =?iso-8859-1?Q?e2LT4yjWvUPETpITZFMQp7WJzt0S0Mhs74cyXBQRqApSP+y1bF8IIPCHgH?= =?iso-8859-1?Q?G170VaE703wUJ1g8L9ADKk+8D1/nZqzMa4LcoRLJHyKW2Sjd2pZkKGKjWz?= =?iso-8859-1?Q?tuAtn4OT8X/eernXP4YMtSghyj7YJ45LMShN2dtq1wlGd/ZfcOCg3xwI0o?= =?iso-8859-1?Q?Ij4ubBG11xZRuvqaZ7c1Nf4jAVAT0ri4HKuTxYnYLXNjR8IpNvmh5LVO7t?= =?iso-8859-1?Q?vNWUB0CiOQ=3D=3D?= Content-Transfer-Encoding: quoted-printable Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-OriginatorOrg: verivus.ai X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: ME0P300MB0853.AUSP300.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-Network-Message-Id: a265329c-69fa-4255-78e8-08de9f8d44e9 X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Apr 2026 10:03:42.8243 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: ccdcedb0-4edc-4cc8-9791-c44ee6610030 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: J/T4QOeUrLF34Xa2PBHx2Kej9HV17/PdMSbV2fqfcfPQ7UVqV1HDe8Rj5mo3lBDjYKw76ftq3OqpX76EbT5BMQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SY9P300MB1529 Content-Type: text/plain; charset="utf-8" bl_parse_deviceid() trusts server-supplied volume indices from XDR without bounds-checking and recurses with no depth limit. A malicious server can trigger an OOB heap read or overflow the kernel stack via crafted GETDEVICEINFO responses. Validate that every child volume index falls within the allocated volumes array, reject nr_volumes =3D=3D 0 before computing the entry-point index, and cap recursion at PNFS_BLOCK_MAX_DEPTH (16). Found by static analysis (sqry). Fixes: 5c83746a0cf2 ("pnfs/blocklayout: in-kernel GETDEVICEINFO XDR parsing= ") Cc: stable@vger.kernel.org # 3.17+ Signed-off-by: Werner Kasselman --- fs/nfs/blocklayout/blocklayout.h | 1 + fs/nfs/blocklayout/dev.c | 54 +++++++++++++++++++++++--------- 2 files changed, 41 insertions(+), 14 deletions(-) diff --git a/fs/nfs/blocklayout/blocklayout.h b/fs/nfs/blocklayout/blocklay= out.h index 6da40ca19570..ec8917cc335d 100644 --- a/fs/nfs/blocklayout/blocklayout.h +++ b/fs/nfs/blocklayout/blocklayout.h @@ -48,6 +48,7 @@ struct pnfs_block_dev; =20 #define PNFS_BLOCK_MAX_UUIDS 4 #define PNFS_BLOCK_MAX_DEVICES 64 +#define PNFS_BLOCK_MAX_DEPTH 16 =20 /* * Random upper cap for the uuid length to avoid unbounded allocation. diff --git a/fs/nfs/blocklayout/dev.c b/fs/nfs/blocklayout/dev.c index cc6327d97a91..d9b1af863535 100644 --- a/fs/nfs/blocklayout/dev.c +++ b/fs/nfs/blocklayout/dev.c @@ -287,7 +287,8 @@ static bool bl_map_stripe(struct pnfs_block_dev *dev, u= 64 offset, =20 static int bl_parse_deviceid(struct nfs_server *server, struct pnfs_block_dev *d, - struct pnfs_block_volume *volumes, int idx, gfp_t gfp_mask); + struct pnfs_block_volume *volumes, int nr_volumes, int idx, + int depth, gfp_t gfp_mask); =20 =20 static int @@ -439,12 +440,14 @@ bl_parse_scsi(struct nfs_server *server, struct pnfs_= block_dev *d, =20 static int bl_parse_slice(struct nfs_server *server, struct pnfs_block_dev *d, - struct pnfs_block_volume *volumes, int idx, gfp_t gfp_mask) + struct pnfs_block_volume *volumes, int nr_volumes, int idx, + int depth, gfp_t gfp_mask) { struct pnfs_block_volume *v =3D &volumes[idx]; int ret; =20 - ret =3D bl_parse_deviceid(server, d, volumes, v->slice.volume, gfp_mask); + ret =3D bl_parse_deviceid(server, d, volumes, nr_volumes, + v->slice.volume, depth + 1, gfp_mask); if (ret) return ret; =20 @@ -455,7 +458,8 @@ bl_parse_slice(struct nfs_server *server, struct pnfs_b= lock_dev *d, =20 static int bl_parse_concat(struct nfs_server *server, struct pnfs_block_dev *d, - struct pnfs_block_volume *volumes, int idx, gfp_t gfp_mask) + struct pnfs_block_volume *volumes, int nr_volumes, int idx, + int depth, gfp_t gfp_mask) { struct pnfs_block_volume *v =3D &volumes[idx]; u64 len =3D 0; @@ -467,8 +471,9 @@ bl_parse_concat(struct nfs_server *server, struct pnfs_= block_dev *d, return -ENOMEM; =20 for (i =3D 0; i < v->concat.volumes_count; i++) { - ret =3D bl_parse_deviceid(server, &d->children[i], - volumes, v->concat.volumes[i], gfp_mask); + ret =3D bl_parse_deviceid(server, &d->children[i], volumes, + nr_volumes, v->concat.volumes[i], + depth + 1, gfp_mask); if (ret) return ret; =20 @@ -484,7 +489,8 @@ bl_parse_concat(struct nfs_server *server, struct pnfs_= block_dev *d, =20 static int bl_parse_stripe(struct nfs_server *server, struct pnfs_block_dev *d, - struct pnfs_block_volume *volumes, int idx, gfp_t gfp_mask) + struct pnfs_block_volume *volumes, int nr_volumes, int idx, + int depth, gfp_t gfp_mask) { struct pnfs_block_volume *v =3D &volumes[idx]; u64 len =3D 0; @@ -496,8 +502,9 @@ bl_parse_stripe(struct nfs_server *server, struct pnfs_= block_dev *d, return -ENOMEM; =20 for (i =3D 0; i < v->stripe.volumes_count; i++) { - ret =3D bl_parse_deviceid(server, &d->children[i], - volumes, v->stripe.volumes[i], gfp_mask); + ret =3D bl_parse_deviceid(server, &d->children[i], volumes, + nr_volumes, v->stripe.volumes[i], + depth + 1, gfp_mask); if (ret) return ret; =20 @@ -513,19 +520,34 @@ bl_parse_stripe(struct nfs_server *server, struct pnf= s_block_dev *d, =20 static int bl_parse_deviceid(struct nfs_server *server, struct pnfs_block_dev *d, - struct pnfs_block_volume *volumes, int idx, gfp_t gfp_mask) + struct pnfs_block_volume *volumes, int nr_volumes, int idx, + int depth, gfp_t gfp_mask) { + if (idx < 0 || idx >=3D nr_volumes) { + dprintk("volume index %d out of range (0..%d)\n", + idx, nr_volumes - 1); + return -EIO; + } + + if (depth >=3D PNFS_BLOCK_MAX_DEPTH) { + dprintk("volume nesting too deep (%d)\n", depth); + return -EIO; + } + d->type =3D volumes[idx].type; =20 switch (d->type) { case PNFS_BLOCK_VOLUME_SIMPLE: return bl_parse_simple(server, d, volumes, idx, gfp_mask); case PNFS_BLOCK_VOLUME_SLICE: - return bl_parse_slice(server, d, volumes, idx, gfp_mask); + return bl_parse_slice(server, d, volumes, nr_volumes, + idx, depth, gfp_mask); case PNFS_BLOCK_VOLUME_CONCAT: - return bl_parse_concat(server, d, volumes, idx, gfp_mask); + return bl_parse_concat(server, d, volumes, nr_volumes, + idx, depth, gfp_mask); case PNFS_BLOCK_VOLUME_STRIPE: - return bl_parse_stripe(server, d, volumes, idx, gfp_mask); + return bl_parse_stripe(server, d, volumes, nr_volumes, + idx, depth, gfp_mask); case PNFS_BLOCK_VOLUME_SCSI: return bl_parse_scsi(server, d, volumes, idx, gfp_mask); default: @@ -559,6 +581,9 @@ bl_alloc_deviceid_node(struct nfs_server *server, struc= t pnfs_device *pdev, goto out_free_scratch; nr_volumes =3D be32_to_cpup(p++); =20 + if (nr_volumes <=3D 0) + goto out_free_scratch; + volumes =3D kzalloc_objs(struct pnfs_block_volume, nr_volumes, gfp_mask); if (!volumes) goto out_free_scratch; @@ -573,7 +598,8 @@ bl_alloc_deviceid_node(struct nfs_server *server, struc= t pnfs_device *pdev, if (!top) goto out_free_volumes; =20 - ret =3D bl_parse_deviceid(server, top, volumes, nr_volumes - 1, gfp_mask); + ret =3D bl_parse_deviceid(server, top, volumes, nr_volumes, + nr_volumes - 1, 0, gfp_mask); =20 node =3D &top->node; nfs4_init_deviceid_node(node, server, &pdev->dev_id); --=20 2.43.0 From nobody Wed Jun 17 01:34:29 2026 Received: from SY5PR01CU010.outbound.protection.outlook.com (mail-australiaeastazon11022105.outbound.protection.outlook.com [40.107.40.105]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5DCFC39FCAC; Tue, 21 Apr 2026 10:03:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.40.105 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776765830; cv=fail; b=sFiivPjHKfSOjDgNn9OFD9UfN1TVa7YUPpE02lAIxxzXrx62GMsWAgoAmSBbIpXK3puJjDj3kRV0aGC31KBFaboqPn66xTcEwy5n5mYstHmtLoZGD8/gOBMl9b2l/KPQkXblNnGUWHjkUoWXgzsvELHlDvKXJT0/s71JpRQeGXs= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776765830; c=relaxed/simple; bh=1qpgihLq9g/Q3izlEesuvt8o2Xo7cOj7UcosuipBBpY=; h=From:To:CC:Subject:Date:Message-ID:References:In-Reply-To: Content-Type:MIME-Version; b=duSctYfIdkAaSZy3kr9kFSEOf0PKUuxbJEYCbNyf46vZLGRkE3jIaW39ecRodKEr33Uor1LYPVM+fUF8pN/BAEZMXPLHrniMKKM/LwK4pJrxukHLx6nQYtctkXS0IIOu5JKe+MwTjY7ITIayNfqszPt4m3mwVsK2oMOMqaKPviM= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=verivus.ai; spf=pass smtp.mailfrom=verivus.ai; dkim=fail (2048-bit key) header.d=verivus.ai header.i=@verivus.ai header.b=TI7OxR3j reason="signature verification failed"; arc=fail smtp.client-ip=40.107.40.105 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=verivus.ai Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=verivus.ai Authentication-Results: smtp.subspace.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=verivus.ai header.i=@verivus.ai header.b="TI7OxR3j" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=do/huFbunlxnIRpMTKTbYuH768x3MWRcIly1mviQlH2gcAuzWxzDEn6ys3QBorO69047Ikqb9YmwFZxdFha/Rd8filCCd+mYo7zY2NKLImFwR9dT61QSNF55XC6NFE3XRv5XgyUP68kSJ5I6CL6Pzbu/RAXv1zOtTEA3BRfEboBPJtiW7uYEzGoqRKxVeNVWD6kq28IYU7WYVfrZd3WlMTblrEIaQmA8q0fACQ9AEYtp19TMOnldmR93c4mR03xXvmMWvCUhsCVz7kp95qc6UCMtiKjtQp4TymUVPB33uuKAuS0+Cr/p/BT9IL5RZaiq4TE5p/T3H1qU1We9bx3ERg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=S7DoKxb/hVXlseKPtErZQyEhdxOFYdLv0+7II1dusYg=; b=RVk9iqtW4ArMDWDJhOmZorFTmFqXjVvJuMaQ+tRnQrBntjUm7cRUt6rTbWMqYq0rWlivlkrN15M+MwIF8aJZjB6sLkiX5GXsc2v3eHkbQSv3ikJG65+WPZegyf6Ebh4E7tMfpUqdqPvz5YMV8yLnrPQ0YabcTbAgIjXQNjKJAFuw3e+s9KzfKEGwInOxYl95jrT3OlFEma8hkcdwjecJOeoCwdG8AmJe4okI3LguXoeheDnZgXP6u+iCpwU2DBG2JNhw6eWnfeqlvuX2HDYoFTJiGxxo9tHyQD1iJcZ5Fu62Qe74zlYFkwidyFU9C60AHNbXDLlyGkTvHLeENslVPw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=verivus.ai; dmarc=pass action=none header.from=verivus.ai; dkim=pass header.d=verivus.ai; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=verivus.ai; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=S7DoKxb/hVXlseKPtErZQyEhdxOFYdLv0+7II1dusYg=; b=TI7OxR3j+M9QD39upA7Tvs5haNRMgwMoGPyvtxVfxj7ZbaSz7Go1aFYiicHcxiYflhGI5CE3M9edaYr+jAZn6u8jw/WEnLEb3fo+OtUbi/aCeHR931X4kioRjCCOn9tzvF9BsyY0Iyp9+oF+REWVYa7XfMBcke/XpV/wNyVcF6T+b96uwZk9rGKwlwgUGl3PDpZYV5MKc3hsis0mkweHqDv1696AzOWHveO6UZu8L1KtbvaDOwW+l9tT6hkaf7Kzv04oq7VT3l1QyBlMxJWYWy0ZM3j0rxTXvP8iAxG7L5dBL3EZ4l8NqF8lmQjO8PFi1tbCca9WP5bd5lig4DoYGA== Received: from ME0P300MB0853.AUSP300.PROD.OUTLOOK.COM (2603:10c6:220:22a::5) by SY9P300MB1529.AUSP300.PROD.OUTLOOK.COM (2603:10c6:10:2d6::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9846.16; Tue, 21 Apr 2026 10:03:44 +0000 Received: from ME0P300MB0853.AUSP300.PROD.OUTLOOK.COM ([fe80::1e3f:9cb9:4a95:b5a2]) by ME0P300MB0853.AUSP300.PROD.OUTLOOK.COM ([fe80::1e3f:9cb9:4a95:b5a2%5]) with mapi id 15.20.9846.017; Tue, 21 Apr 2026 10:03:44 +0000 From: Werner Kasselman To: Trond Myklebust , Anna Schumaker CC: Christoph Hellwig , "linux-nfs@vger.kernel.org" , "linux-kernel@vger.kernel.org" , "stable@vger.kernel.org" , Werner Kasselman Subject: [PATCH 2/2] pnfs/blocklayout: cap total parse operations in volume topology Thread-Topic: [PATCH 2/2] pnfs/blocklayout: cap total parse operations in volume topology Thread-Index: AQHc0XYj7nnCqxfCHEWqw//Ynpi3KQ== Date: Tue, 21 Apr 2026 10:03:44 +0000 Message-ID: <20260421100338.1227152-3-werner@verivus.com> References: <20260421100338.1227152-1-werner@verivus.com> In-Reply-To: <20260421100338.1227152-1-werner@verivus.com> Accept-Language: en-AU, en-AT, en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-mailer: git-send-email 2.43.0 authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=verivus.ai; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: ME0P300MB0853:EE_|SY9P300MB1529:EE_ x-ms-office365-filtering-correlation-id: 9ae4d0cd-fd57-4f6b-77b0-08de9f8d460a x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|376014|366016|1800799024|38070700021|18002099003|22082099003|56012099003; x-microsoft-antispam-message-info: 0AxBtqAm7IEk31mL7N7Qbr0r3p70TyaDT6deKQPq01ewkpObHV4PDVC/Kg/E9rA9oXCAS7JLSiocrQbEanlb0Ryx4LjOefvvqhtkSrXNBoy6iGSzpadHtkW/eEshQ5ca4HbqAUp6Qwp2vaOPC5h1e88MCRiNojHaGAMYpYURe1WkudY5DAJqZmceNCIZAzW5ty3k7KlVlNnLk0pg7ZEMsjdve7qWW40XaDyttRuTz7gG9KBj642/vTWPFL5hRjQmWrteD/GNMHUe2lmuvE++4ueM+o08XfXFrk3yrQREvz3+pmAMVT4wZBs9Hi3Z6JfXgmvIMmbf3SNBfY5KiURLKfS6pZJ+LLjXypE5GfIOHZU7EmDuyF5cxAhujHj3BBtWof8HwuFFvMWeL+UCWaXKJuJKcf3TDdQw6creS+Fu2yBeu9pit9gVUNVOUpiqLgCFjFUprZW9cn6tnxzUzQa1KYdG/NH+nYiOd3svuAqKLXN8/ZSu7qF1nWbp//wjE11NNXyTN8M7WWX99Nh96+DBRHMP+87USov/bdRZZ182/t+1pWFwPgJRTq7pMnOLJGtSrUQjxTRQcCgigmB9Ai/SEfqB+kha5afJcDd8KYkLikNnsujgBi+ivpA+t9u4GdYQpBVuF9k9txLbthnVm3K6NeBoodrVoKkgH6Atj5Y0BIUs4APezj2Jtne+ayCxIM+E3zmXlMvSQVIyW8n2CfgrBCsHtWleQFewDMa6TKoRFQ102dZ0hV6MaD/Ifh6LXFKNdRiZ1wz0ydTdewhkFISAAdGydSJHqw8C/9Ew2pOyo1s= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:ME0P300MB0853.AUSP300.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(376014)(366016)(1800799024)(38070700021)(18002099003)(22082099003)(56012099003);DIR:OUT;SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?br0qsDn233WwjdHbTKtLHUSXyf30g83fxnYwDKSjo6WTUo7Q2Ecb99ocFU?= =?iso-8859-1?Q?oRXkhmfIJlWj+i64Np7LiDo001IAoWGV7La2rgvr2Bn7mIeY8AlIaUuD5P?= =?iso-8859-1?Q?LiUFQ3W14Utko163TmgKYn5ZKK4RDP/NyWwbWFsDyLov/CCJrJ7YUvESh6?= =?iso-8859-1?Q?mPQMnG7uj52weHnMUhMxKy9oOg9I4arv1T5X491UA6CPZmPFJ9ipu9/dWb?= =?iso-8859-1?Q?P9xHXsZOqbBl7LgEOot3gnZnK0OJPNRkSQ7kR9p7fiFAaRpdTBhpKr6FWF?= =?iso-8859-1?Q?SR90oqaM6J63HUj6xZSGul9/ZhhukE15PF0OdmvL0L4aiA+3IuYQBOOBIN?= =?iso-8859-1?Q?M4zaB077ukrGUlay14IfjDqfWJB3HWt/N6HkRPY68xBd+4YML1z3d5MTEq?= =?iso-8859-1?Q?jd4WEYJi71jalWp2hAOJYp+RfavByyG8d/t3tnPNljMsKmdgecRvuY/nkq?= =?iso-8859-1?Q?HVm45TJE45CUAlDx2nmWN20tXZFbCtbeCkr9lSBywC0gFkQfuL6wOnzNi+?= =?iso-8859-1?Q?UIhm0YpmygjK0g2FN80jKApTVPLsRJgy5hazmY0VLTO5n+Nq5gSBF9RGa8?= =?iso-8859-1?Q?V1PTulqdLTorP9+AIM9gBxeIoB0VMyj9Tjt8gOiPtzA5WV20GC/aMmYIWA?= =?iso-8859-1?Q?oEqeP5GfdNXt6bYb1ztMOODdZN4A/m4Oe0utqlaY+KztwabtirldZ6+4Y5?= =?iso-8859-1?Q?mOkMKgFCNcisd5zfhtMFfXiOMd+YJY1EyPduJsBkz7nyNbw06+xDFOAa8r?= =?iso-8859-1?Q?OUbnavGZbRmfdtAH3w2MFw4U8Yd+6CSoW4VeRoHShxoux9oOH0leu11j4g?= =?iso-8859-1?Q?s6MNeUprwkMnxbZ3Ebr5Orn4ndGp7J8vKeaHnJc25HMj8NDMdvByJv9Q0L?= =?iso-8859-1?Q?O5jvS74m8P5b4UqMZAQjUr0yvkC6U/+GO/mfwG5QLEx66nh2X3RHdOCJ43?= =?iso-8859-1?Q?oA9XZ4j2/7La+f9E8v9WyY0DDWS1YrehHc/8LaLfrAx3Eh/b65TRVknfEE?= =?iso-8859-1?Q?tXg2IuZN75uGdc/jwk7L45p/ih5iM0ZCrElWoOlJqbFii7n06v7NvmwguF?= =?iso-8859-1?Q?QlEYzIkzD7EIIGDH4nOTvQgmNsb3avprZ0CVHVAy4Lys01UhYwRFtQRt3j?= =?iso-8859-1?Q?+n9gRzCODIql2OYy97P8YtR5alldBqo04a+sX9KDMGX9LLhRAa7UOV/Rp+?= =?iso-8859-1?Q?2pyQ0AFD/JuBlF/hyJBp5lSfeZ0BsevlERGe1813NJ+bhy+8Qbdvc5sC1G?= =?iso-8859-1?Q?mkXXAh5QC2B3ZT80rHOQs/UapVwxDZmjvS2dYlXVuww++W8avYfLeXOB67?= =?iso-8859-1?Q?PpQcthfuOcC22FkG1sqwx8Q0oiwYDrrsK1Vl4IJM8Y0fYHpCq7ehICuLSR?= =?iso-8859-1?Q?Mg1UhgGZwNtMhQgOhI7WB/v4scAdHzgPdQ+oIAvabzt0Ik4xLPW3S5aFXp?= =?iso-8859-1?Q?oOPhUE7nvbzxKVrUp7+rXtohEvxCb2CpFa+zo8ZVtaBx7pD8yEuI4cFLUZ?= =?iso-8859-1?Q?UCACq/j/MJ0+yoCySPDiVdLXq09UNSOVubVD8AlD7SQd2eM9IrBU/twZC/?= =?iso-8859-1?Q?AsqiyFJ0wejSufno0/MNU7oarH853//hCvRz+Dc7JSt5TAuaoDoXo1NDWF?= =?iso-8859-1?Q?Inr9cxGE5773n+egMHcYnJmKT3OxWAaZOhLUKPMwe0LVT+R/qvDUR1fTJo?= =?iso-8859-1?Q?/JqVWXC0Aa2523hl94jrk0m85f99vm9HuvTjgPTuNeWI/2rlbGMU3EgaaG?= =?iso-8859-1?Q?PC9JvgHDj+1Fp6Dodw5C18y1lEY89oLhFiQasLf9GD2crQZ1tLJjE3AfjF?= =?iso-8859-1?Q?SkA/LaCjfA=3D=3D?= Content-Transfer-Encoding: quoted-printable Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-OriginatorOrg: verivus.ai X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: ME0P300MB0853.AUSP300.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-Network-Message-Id: 9ae4d0cd-fd57-4f6b-77b0-08de9f8d460a X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Apr 2026 10:03:44.7412 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: ccdcedb0-4edc-4cc8-9791-c44ee6610030 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 53c4awuU4qNIQQppTmgR9XHcw92z5DbWosrpkGWXGfYAa/xx3sSoSnm5aBd6fSovMqhv6HQuAVjyxmcqXih9rw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SY9P300MB1529 Content-Type: text/plain; charset="utf-8" The recursive-descent volume parser materializes a separate device tree node for every volume reference. When CONCAT or STRIPE volumes reference the same child index, the parser re-parses that subtree for each reference, causing work exponential in nesting depth. Cap the total number of bl_parse_deviceid() calls at PNFS_BLOCK_MAX_PARSE_OPS (1024) to bound CPU and memory consumption from server-controlled GETDEVICEINFO topologies. Signed-off-by: Werner Kasselman --- fs/nfs/blocklayout/blocklayout.h | 1 + fs/nfs/blocklayout/dev.c | 31 +++++++++++++++++++------------ 2 files changed, 20 insertions(+), 12 deletions(-) diff --git a/fs/nfs/blocklayout/blocklayout.h b/fs/nfs/blocklayout/blocklay= out.h index ec8917cc335d..6c00d98d4317 100644 --- a/fs/nfs/blocklayout/blocklayout.h +++ b/fs/nfs/blocklayout/blocklayout.h @@ -49,6 +49,7 @@ struct pnfs_block_dev; #define PNFS_BLOCK_MAX_UUIDS 4 #define PNFS_BLOCK_MAX_DEVICES 64 #define PNFS_BLOCK_MAX_DEPTH 16 +#define PNFS_BLOCK_MAX_PARSE_OPS 1024 =20 /* * Random upper cap for the uuid length to avoid unbounded allocation. diff --git a/fs/nfs/blocklayout/dev.c b/fs/nfs/blocklayout/dev.c index d9b1af863535..6e0df65c9b1f 100644 --- a/fs/nfs/blocklayout/dev.c +++ b/fs/nfs/blocklayout/dev.c @@ -288,7 +288,7 @@ static bool bl_map_stripe(struct pnfs_block_dev *dev, u= 64 offset, static int bl_parse_deviceid(struct nfs_server *server, struct pnfs_block_dev *d, struct pnfs_block_volume *volumes, int nr_volumes, int idx, - int depth, gfp_t gfp_mask); + int depth, int *remaining, gfp_t gfp_mask); =20 =20 static int @@ -441,13 +441,14 @@ bl_parse_scsi(struct nfs_server *server, struct pnfs_= block_dev *d, static int bl_parse_slice(struct nfs_server *server, struct pnfs_block_dev *d, struct pnfs_block_volume *volumes, int nr_volumes, int idx, - int depth, gfp_t gfp_mask) + int depth, int *remaining, gfp_t gfp_mask) { struct pnfs_block_volume *v =3D &volumes[idx]; int ret; =20 ret =3D bl_parse_deviceid(server, d, volumes, nr_volumes, - v->slice.volume, depth + 1, gfp_mask); + v->slice.volume, depth + 1, remaining, + gfp_mask); if (ret) return ret; =20 @@ -459,7 +460,7 @@ bl_parse_slice(struct nfs_server *server, struct pnfs_b= lock_dev *d, static int bl_parse_concat(struct nfs_server *server, struct pnfs_block_dev *d, struct pnfs_block_volume *volumes, int nr_volumes, int idx, - int depth, gfp_t gfp_mask) + int depth, int *remaining, gfp_t gfp_mask) { struct pnfs_block_volume *v =3D &volumes[idx]; u64 len =3D 0; @@ -473,7 +474,7 @@ bl_parse_concat(struct nfs_server *server, struct pnfs_= block_dev *d, for (i =3D 0; i < v->concat.volumes_count; i++) { ret =3D bl_parse_deviceid(server, &d->children[i], volumes, nr_volumes, v->concat.volumes[i], - depth + 1, gfp_mask); + depth + 1, remaining, gfp_mask); if (ret) return ret; =20 @@ -490,7 +491,7 @@ bl_parse_concat(struct nfs_server *server, struct pnfs_= block_dev *d, static int bl_parse_stripe(struct nfs_server *server, struct pnfs_block_dev *d, struct pnfs_block_volume *volumes, int nr_volumes, int idx, - int depth, gfp_t gfp_mask) + int depth, int *remaining, gfp_t gfp_mask) { struct pnfs_block_volume *v =3D &volumes[idx]; u64 len =3D 0; @@ -504,7 +505,7 @@ bl_parse_stripe(struct nfs_server *server, struct pnfs_= block_dev *d, for (i =3D 0; i < v->stripe.volumes_count; i++) { ret =3D bl_parse_deviceid(server, &d->children[i], volumes, nr_volumes, v->stripe.volumes[i], - depth + 1, gfp_mask); + depth + 1, remaining, gfp_mask); if (ret) return ret; =20 @@ -521,7 +522,7 @@ bl_parse_stripe(struct nfs_server *server, struct pnfs_= block_dev *d, static int bl_parse_deviceid(struct nfs_server *server, struct pnfs_block_dev *d, struct pnfs_block_volume *volumes, int nr_volumes, int idx, - int depth, gfp_t gfp_mask) + int depth, int *remaining, gfp_t gfp_mask) { if (idx < 0 || idx >=3D nr_volumes) { dprintk("volume index %d out of range (0..%d)\n", @@ -534,6 +535,11 @@ bl_parse_deviceid(struct nfs_server *server, struct pn= fs_block_dev *d, return -EIO; } =20 + if (--(*remaining) < 0) { + dprintk("volume topology too complex\n"); + return -EIO; + } + d->type =3D volumes[idx].type; =20 switch (d->type) { @@ -541,13 +547,13 @@ bl_parse_deviceid(struct nfs_server *server, struct p= nfs_block_dev *d, return bl_parse_simple(server, d, volumes, idx, gfp_mask); case PNFS_BLOCK_VOLUME_SLICE: return bl_parse_slice(server, d, volumes, nr_volumes, - idx, depth, gfp_mask); + idx, depth, remaining, gfp_mask); case PNFS_BLOCK_VOLUME_CONCAT: return bl_parse_concat(server, d, volumes, nr_volumes, - idx, depth, gfp_mask); + idx, depth, remaining, gfp_mask); case PNFS_BLOCK_VOLUME_STRIPE: return bl_parse_stripe(server, d, volumes, nr_volumes, - idx, depth, gfp_mask); + idx, depth, remaining, gfp_mask); case PNFS_BLOCK_VOLUME_SCSI: return bl_parse_scsi(server, d, volumes, idx, gfp_mask); default: @@ -567,6 +573,7 @@ bl_alloc_deviceid_node(struct nfs_server *server, struc= t pnfs_device *pdev, struct xdr_buf buf; struct folio *scratch; int nr_volumes, ret, i; + int remaining =3D PNFS_BLOCK_MAX_PARSE_OPS; __be32 *p; =20 scratch =3D folio_alloc(gfp_mask, 0); @@ -599,7 +606,7 @@ bl_alloc_deviceid_node(struct nfs_server *server, struc= t pnfs_device *pdev, goto out_free_volumes; =20 ret =3D bl_parse_deviceid(server, top, volumes, nr_volumes, - nr_volumes - 1, 0, gfp_mask); + nr_volumes - 1, 0, &remaining, gfp_mask); =20 node =3D &top->node; nfs4_init_deviceid_node(node, server, &pdev->dev_id); --=20 2.43.0