]> git.baikalelectronics.ru Git - kernel.git/commit
NFSD: Fix crash encoding lock reply on 32-bit
authorKinglong Mee <kinglongmee@gmail.com>
Mon, 7 Jul 2014 14:10:56 +0000 (22:10 +0800)
committerJ. Bruce Fields <bfields@redhat.com>
Wed, 23 Jul 2014 14:31:56 +0000 (10:31 -0400)
commit7a94339615ff29b91023c7f1610f00388f6a1642
treede5ccad7c101e5f307f7cd3686477675de40b81c
parentd8c312adc9b7b006194e4fad2109cc4199f7f7ac
NFSD: Fix crash encoding lock reply on 32-bit

Commit e8c451df28 "nfsd4: don't try to encode conflicting owner if low
on space" forgot to free conf->data in nfsd4_encode_lockt and before
sign conf->data to NULL in nfsd4_encode_lock_denied, causing a leak.

Worse, kfree() can be called on an uninitialized pointer in the case of
a succesful lock (or one that fails for a reason other than a conflict).

(Note that lock->lk_denied.ld_owner.data appears it should be zero here,
until you notice that it's one arm of a union the other arm of which is
written to in the succesful case by the

memcpy(&lock->lk_resp_stateid, &lock_stp->st_stid.sc_stateid,
                                sizeof(stateid_t));

in nfsd4_lock().  In the 32-bit case this overwrites ld_owner.data.)

Signed-off-by: Kinglong Mee <kinglongmee@gmail.com>
Fixes: e8c451df28 ""nfsd4: don't try to encode conflicting owner if low on space"
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
fs/nfsd/nfs4xdr.c