Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

SUNRPC: Fix a double-free in rpcbind

Browse source 
It is wrong to be freeing up the rpcbind arguments if the call to
rpcb_call_async() fails, since they should already have been freed up by
rpcb_map_release().

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
This commit is contained in:
Trond Myklebust 2008-07-07 12:18:52 -04:00
parent 2aac05a919
commit 0d3a34b48c
1 changed files with 2 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
net/sunrpc/rpcb_clnt.c
View file

@ -365,18 +365,16 @@ void rpcb_getport_async(struct rpc_task *task)
rpc_release_client(rpcb_clnt);
if (IS_ERR(child)) {
status = -EIO;
/* rpcb_map_release() has freed the arguments */
dprintk("RPC: %5u %s: rpc_run_task failed\n",
task->tk_pid, __func__);
goto bailout;
goto bailout_nofree;
}
rpc_put_task(child);
task->tk_xprt->stat.bind_count++;
return;
bailout:
kfree(map);
xprt_put(xprt);
bailout_nofree:
rpcb_wake_rpcbind_waiters(xprt, status);
bailout_nowake: