diff options
| author | NeilBrown <neilb@suse.de> | 2012-12-13 15:14:36 +1100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2013-01-11 09:03:37 -0800 |
| commit | 64b45c804286cb18c50b387169b7da64279bc1ed (patch) | |
| tree | 5481b0f16439ac8b9745377ad68fced4720f673d /fs | |
| parent | 611d6f03ec50fe38c6753ada7ffbed3febb862c1 (diff) | |
| download | lwn-64b45c804286cb18c50b387169b7da64279bc1ed.tar.gz lwn-64b45c804286cb18c50b387169b7da64279bc1ed.zip | |
NFS: avoid NULL dereference in nfs_destroy_server
commit f259613a1e4b44a0cf85a5dafd931be96ee7c9e5 upstream.
In rare circumstances, nfs_clone_server() of a v2 or v3 server can get
an error between setting server->destory (to nfs_destroy_server), and
calling nfs_start_lockd (which will set server->nlm_host).
If this happens, nfs_clone_server will call nfs_free_server which
will call nfs_destroy_server and thence nlmclnt_done(NULL). This
causes the NULL to be dereferenced.
So add a guard to only call nlmclnt_done() if ->nlm_host is not NULL.
The other guards there are irrelevant as nlm_host can only be non-NULL
if one of these flags are set - so remove those tests. (Thanks to Trond
for this suggestion).
This is suitable for any stable kernel since 2.6.25.
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/nfs/client.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/fs/nfs/client.c b/fs/nfs/client.c index b3dc2b88b65b..0cb731f26fe9 100644 --- a/fs/nfs/client.c +++ b/fs/nfs/client.c @@ -673,8 +673,7 @@ static int nfs_create_rpc_client(struct nfs_client *clp, */ static void nfs_destroy_server(struct nfs_server *server) { - if (!(server->flags & NFS_MOUNT_LOCAL_FLOCK) || - !(server->flags & NFS_MOUNT_LOCAL_FCNTL)) + if (server->nlm_host) nlmclnt_done(server->nlm_host); } |