nfsd CopySetup Leak

Vulnerability analysis

When an NFSv4 COPY operation fails during inter-server or intra-server source setup, the error-handling path returns immediately instead of jumping to the normal cleanup label, skipping the routine that releases the destination file reference acquired earlier in the request. Each failed COPY therefore leaks one kernel file object, permanently pinning the associated file, inode, dentry, and mount point. An authenticated NFS client can trigger this repeatedly by sending COPY compounds whose setup fails, gradually exhausting server memory and filesystem resources until the NFS server or the entire kernel becomes unresponsive. The fix routes all copy-setup error paths through the existing cleanup label so the reference is always released. The vulnerable code path is reachable from any network client that can issue NFSv4 COPY operations and requires the server to have the inter-server copy offload feature enabled for the inter-server variant; the intra-server variant is reachable without that parameter.