lkml.org 
[lkml]   [2013]   [Jan]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[ 043/123] NFS: avoid NULL dereference in nfs_destroy_server
    Date
    3.7-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: NeilBrown <neilb@suse.de>

    commit f259613a1e4b44a0cf85a5dafd931be96ee7c9e5 upstream.

    In rare circumstances, nfs_clone_server() of a v2 or v3 server can get
    an error between setting server->destory (to nfs_destroy_server), and
    calling nfs_start_lockd (which will set server->nlm_host).

    If this happens, nfs_clone_server will call nfs_free_server which
    will call nfs_destroy_server and thence nlmclnt_done(NULL). This
    causes the NULL to be dereferenced.

    So add a guard to only call nlmclnt_done() if ->nlm_host is not NULL.

    The other guards there are irrelevant as nlm_host can only be non-NULL
    if one of these flags are set - so remove those tests. (Thanks to Trond
    for this suggestion).

    This is suitable for any stable kernel since 2.6.25.

    Signed-off-by: NeilBrown <neilb@suse.de>
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    fs/nfs/client.c | 3 +--
    1 file changed, 1 insertion(+), 2 deletions(-)

    --- a/fs/nfs/client.c
    +++ b/fs/nfs/client.c
    @@ -615,8 +615,7 @@ EXPORT_SYMBOL_GPL(nfs_create_rpc_client)
    */
    static void nfs_destroy_server(struct nfs_server *server)
    {
    - if (!(server->flags & NFS_MOUNT_LOCAL_FLOCK) ||
    - !(server->flags & NFS_MOUNT_LOCAL_FCNTL))
    + if (server->nlm_host)
    nlmclnt_done(server->nlm_host);
    }




    \
     
     \ /
      Last update: 2013-01-10 04:41    [W:2.794 / U:1.492 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site