| From f259613a1e4b44a0cf85a5dafd931be96ee7c9e5 Mon Sep 17 00:00:00 2001 |
| From: NeilBrown <neilb@suse.de> |
| Date: Thu, 13 Dec 2012 15:14:36 +1100 |
| Subject: NFS: avoid NULL dereference in nfs_destroy_server |
| |
| From: NeilBrown <neilb@suse.de> |
| |
| commit f259613a1e4b44a0cf85a5dafd931be96ee7c9e5 upstream. |
| |
| In rare circumstances, nfs_clone_server() of a v2 or v3 server can get |
| an error between setting server->destory (to nfs_destroy_server), and |
| calling nfs_start_lockd (which will set server->nlm_host). |
| |
| If this happens, nfs_clone_server will call nfs_free_server which |
| will call nfs_destroy_server and thence nlmclnt_done(NULL). This |
| causes the NULL to be dereferenced. |
| |
| So add a guard to only call nlmclnt_done() if ->nlm_host is not NULL. |
| |
| The other guards there are irrelevant as nlm_host can only be non-NULL |
| if one of these flags are set - so remove those tests. (Thanks to Trond |
| for this suggestion). |
| |
| This is suitable for any stable kernel since 2.6.25. |
| |
| Signed-off-by: NeilBrown <neilb@suse.de> |
| Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| fs/nfs/client.c | 3 +-- |
| 1 file changed, 1 insertion(+), 2 deletions(-) |
| |
| --- a/fs/nfs/client.c |
| +++ b/fs/nfs/client.c |
| @@ -615,8 +615,7 @@ EXPORT_SYMBOL_GPL(nfs_create_rpc_client) |
| */ |
| static void nfs_destroy_server(struct nfs_server *server) |
| { |
| - if (!(server->flags & NFS_MOUNT_LOCAL_FLOCK) || |
| - !(server->flags & NFS_MOUNT_LOCAL_FCNTL)) |
| + if (server->nlm_host) |
| nlmclnt_done(server->nlm_host); |
| } |
| |
