Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

[PATCH] Fix a free-wrong-pointer bug in nfs/acl server.

Browse source 
Due to type confusion, when an nfsacl verison 2 'ACCESS' request
finishes and tries to clean up, it calls fh_put on entiredly the
wrong thing and this can cause an oops.

Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Greg Banks 2007-02-20 10:12:34 +11:00 committed by Linus Torvalds
parent 575d5e72aa
commit c9ce228306
1 changed files with 12 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
fs/nfsd/nfs2acl.c
View file

@ -287,13 +287,20 @@ static int nfsaclsvc_release_getacl(struct svc_rqst *rqstp, __be32 *p,
return 1; return 1;
} }
static int nfsaclsvc_release_fhandle(struct svc_rqst *rqstp, __be32 *p, static int nfsaclsvc_release_attrstat(struct svc_rqst *rqstp, __be32 *p,
struct nfsd_fhandle *resp) struct nfsd_attrstat *resp)
{ {
fh_put(&resp->fh); fh_put(&resp->fh);
return 1; return 1;
} }
static int nfsaclsvc_release_access(struct svc_rqst *rqstp, __be32 *p,
struct nfsd3_accessres *resp)
{
fh_put(&resp->fh);
return 1;
}
#define nfsaclsvc_decode_voidargs NULL #define nfsaclsvc_decode_voidargs NULL
#define nfsaclsvc_encode_voidres NULL #define nfsaclsvc_encode_voidres NULL
#define nfsaclsvc_release_void NULL #define nfsaclsvc_release_void NULL
@ -322,9 +329,9 @@ struct nfsd3_voidargs { int dummy; };
static struct svc_procedure nfsd_acl_procedures2[] = { static struct svc_procedure nfsd_acl_procedures2[] = {
PROC(null, void, void, void, RC_NOCACHE, ST), PROC(null, void, void, void, RC_NOCACHE, ST),
PROC(getacl, getacl, getacl, getacl, RC_NOCACHE, ST+1+2*(1+ACL)), PROC(getacl, getacl, getacl, getacl, RC_NOCACHE, ST+1+2*(1+ACL)),
PROC(setacl, setacl, attrstat, fhandle, RC_NOCACHE, ST+AT), PROC(setacl, setacl, attrstat, attrstat, RC_NOCACHE, ST+AT),
PROC(getattr, fhandle, attrstat, fhandle, RC_NOCACHE, ST+AT), PROC(getattr, fhandle, attrstat, attrstat, RC_NOCACHE, ST+AT),
PROC(access, access, access, fhandle, RC_NOCACHE, ST+AT+1), PROC(access, access, access, access, RC_NOCACHE, ST+AT+1),
}; };
struct svc_version nfsd_acl_version2 = { struct svc_version nfsd_acl_version2 = {