| From bb6ad5572c0022e17e846b382d7413cdcf8055be Mon Sep 17 00:00:00 2001 |
| From: Trond Myklebust <trondmy@gmail.com> |
| Date: Tue, 9 Oct 2018 15:54:15 -0400 |
| Subject: nfsd: Fix an Oops in free_session() |
| |
| From: Trond Myklebust <trondmy@gmail.com> |
| |
| commit bb6ad5572c0022e17e846b382d7413cdcf8055be upstream. |
| |
| In call_xpt_users(), we delete the entry from the list, but we |
| do not reinitialise it. This triggers the list poisoning when |
| we later call unregister_xpt_user() in nfsd4_del_conns(). |
| |
| Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com> |
| Cc: stable@vger.kernel.org |
| Signed-off-by: J. Bruce Fields <bfields@redhat.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| net/sunrpc/svc_xprt.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/net/sunrpc/svc_xprt.c |
| +++ b/net/sunrpc/svc_xprt.c |
| @@ -1038,7 +1038,7 @@ static void call_xpt_users(struct svc_xp |
| spin_lock(&xprt->xpt_lock); |
| while (!list_empty(&xprt->xpt_users)) { |
| u = list_first_entry(&xprt->xpt_users, struct svc_xpt_user, list); |
| - list_del(&u->list); |
| + list_del_init(&u->list); |
| u->callback(u); |
| } |
| spin_unlock(&xprt->xpt_lock); |
