diff options
| author | Kinglong Mee <kinglongmee@gmail.com> | 2017-01-18 12:04:42 +0100 |
|---|---|---|
| committer | J. Bruce Fields <bfields@redhat.com> | 2017-01-31 18:29:24 +0100 |
| commit | d19fb70dd68c4e960e2ac09b0b9c79dfdeefa726 (patch) | |
| tree | 8ce91162810ddf366f475ca22861c705aea115fa /fs/nfsd/state.h | |
| parent | Linux 4.10-rc6 (diff) | |
| download | linux-d19fb70dd68c4e960e2ac09b0b9c79dfdeefa726.tar.xz linux-d19fb70dd68c4e960e2ac09b0b9c79dfdeefa726.zip | |
NFSD: Fix a null reference case in find_or_create_lock_stateid()
nfsd assigns the nfs4_free_lock_stateid to .sc_free in init_lock_stateid().
If nfsd doesn't go through init_lock_stateid() and put stateid at end,
there is a NULL reference to .sc_free when calling nfs4_put_stid(ns).
This patch let the nfs4_stid.sc_free assignment to nfs4_alloc_stid().
Cc: stable@vger.kernel.org
Fixes: 356a95ece7aa "nfsd: clean up races in lock stateid searching..."
Signed-off-by: Kinglong Mee <kinglongmee@gmail.com>
Reviewed-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Diffstat (limited to 'fs/nfsd/state.h')
| -rw-r--r-- | fs/nfsd/state.h | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h index c9399366f9df..4516e8b7d776 100644 --- a/fs/nfsd/state.h +++ b/fs/nfsd/state.h @@ -603,8 +603,8 @@ extern __be32 nfs4_preprocess_stateid_op(struct svc_rqst *rqstp, __be32 nfsd4_lookup_stateid(struct nfsd4_compound_state *cstate, stateid_t *stateid, unsigned char typemask, struct nfs4_stid **s, struct nfsd_net *nn); -struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, - struct kmem_cache *slab); +struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, struct kmem_cache *slab, + void (*sc_free)(struct nfs4_stid *)); void nfs4_unhash_stid(struct nfs4_stid *s); void nfs4_put_stid(struct nfs4_stid *s); void nfs4_inc_and_copy_stateid(stateid_t *dst, struct nfs4_stid *stid); |