Commit f259613a1e4b44a0cf85a5dafd931be96ee7c9e5
Committed by
Trond Myklebust
1 parent
eb96d5c97b
Exists in
smarc-l5.0.0_1.0.0-ga
and in
5 other branches
NFS: avoid NULL dereference in nfs_destroy_server
In rare circumstances, nfs_clone_server() of a v2 or v3 server can get an error between setting server->destory (to nfs_destroy_server), and calling nfs_start_lockd (which will set server->nlm_host). If this happens, nfs_clone_server will call nfs_free_server which will call nfs_destroy_server and thence nlmclnt_done(NULL). This causes the NULL to be dereferenced. So add a guard to only call nlmclnt_done() if ->nlm_host is not NULL. The other guards there are irrelevant as nlm_host can only be non-NULL if one of these flags are set - so remove those tests. (Thanks to Trond for this suggestion). This is suitable for any stable kernel since 2.6.25. Cc: stable@vger.kernel.org Signed-off-by: NeilBrown <neilb@suse.de> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Showing 1 changed file with 1 additions and 2 deletions Side-by-side Diff
fs/nfs/client.c
... | ... | @@ -615,8 +615,7 @@ |
615 | 615 | */ |
616 | 616 | static void nfs_destroy_server(struct nfs_server *server) |
617 | 617 | { |
618 | - if (!(server->flags & NFS_MOUNT_LOCAL_FLOCK) || | |
619 | - !(server->flags & NFS_MOUNT_LOCAL_FCNTL)) | |
618 | + if (server->nlm_host) | |
620 | 619 | nlmclnt_done(server->nlm_host); |
621 | 620 | } |
622 | 621 |