2013-03-18 14:49:12

by Jeff Layton

Subject: [PATCH] nfsd: only unhash DRC entries that are in the hashtable

It's not safe to call hlist_del() on a newly initialized hlist_node.
That leads to a NULL pointer dereference. Only do that if the entry
is hashed.

Signed-off-by: Jeff Layton <[email protected]>
---
fs/nfsd/nfscache.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/nfsd/nfscache.c b/fs/nfsd/nfscache.c
index f5ad28e..ca05f6d 100644
--- a/fs/nfsd/nfscache.c
+++ b/fs/nfsd/nfscache.c
@@ -102,7 +102,8 @@ nfsd_reply_cache_free_locked(struct svc_cacherep *rp)
{
if (rp->c_type == RC_REPLBUFF)
kfree(rp->c_replvec.iov_base);
- hlist_del(&rp->c_hash);
+ if (!hlist_unhashed(&rp->c_hash))
+ hlist_del(&rp->c_hash);
list_del(&rp->c_lru);
--num_drc_entries;
kmem_cache_free(drc_slab, rp);
--
1.7.11.7

2013-03-18 14:57:03

by J. Bruce Fields

Subject: Re: [PATCH] nfsd: only unhash DRC entries that are in the hashtable

On Mon, Mar 18, 2013 at 10:49:07AM -0400, Jeff Layton wrote:
> It's not safe to call hlist_del() on a newly initialized hlist_node.
> That leads to a NULL pointer dereference. Only do that if the entry
> is hashed.

Thanks! Applying for 3.9.--b.

>
> Signed-off-by: Jeff Layton <[email protected]>
> ---
> fs/nfsd/nfscache.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/fs/nfsd/nfscache.c b/fs/nfsd/nfscache.c
> index f5ad28e..ca05f6d 100644
> --- a/fs/nfsd/nfscache.c
> +++ b/fs/nfsd/nfscache.c
> @@ -102,7 +102,8 @@ nfsd_reply_cache_free_locked(struct svc_cacherep *rp)
> {
> if (rp->c_type == RC_REPLBUFF)
> kfree(rp->c_replvec.iov_base);
> - hlist_del(&rp->c_hash);
> + if (!hlist_unhashed(&rp->c_hash))
> + hlist_del(&rp->c_hash);
> list_del(&rp->c_lru);
> --num_drc_entries;
> kmem_cache_free(drc_slab, rp);
> --
> 1.7.11.7
>