lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

SUNRPC: Fix a use after free bug with the NFSv4.1 backchannel

Browse Source 
The ->release_request() callback was designed to allow the transport layer
to do housekeeping after the RPC call is done. It cannot be used to free
the request itself, and doing so leads to a use-after-free bug in
xprt_release().

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
This commit is contained in:
Trond Myklebust
2010-03-19 15:36:22 -04:00
parent cdead7cf12
commit c9acb42ef1
4 changed files with 13 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
net/sunrpc/xprtsock.c
View File

@@ -2251,9 +2251,6 @@ static struct rpc_xprt_ops xs_tcp_ops = {
.buf_free = rpc_free,
.send_request = xs_tcp_send_request,
.set_retrans_timeout = xprt_set_retrans_timeout_def,
#if defined(CONFIG_NFS_V4_1)
.release_request = bc_release_request,
#endif /* CONFIG_NFS_V4_1 */
.close = xs_tcp_close,
.destroy = xs_destroy,
.print_stats = xs_tcp_print_stats,