2014-01-20 23:33:01

by Trond Myklebust

Subject: Re: [PATCH 1/2] nfs4: fix discover_server_trunking use after free

On Jan 19, 2014, at 20:45, Weston Andros Adamson <[email protected]> wrote:

> If clp is new (cl_count = 1) and it matches another client in
> nfs4_discover_server_trunking, the nfs_put_client will free clp before
> ->cl_preserve_clid is set.
>
> Cc: [email protected] # 3.7+
> Signed-off-by: Weston Andros Adamson <[email protected]>
> ---
> fs/nfs/nfs4client.c | 7 ++++---
> 1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
> index c1b7a80..0f9b772 100644
> --- a/fs/nfs/nfs4client.c
> +++ b/fs/nfs/nfs4client.c
> @@ -414,11 +414,12 @@ struct nfs_client *nfs4_init_client(struct nfs_client *clp,
> error = nfs4_discover_server_trunking(clp, &old);
> if (error < 0)
> goto error;
> - nfs_put_client(clp);
> - if (clp != old) {
> +
> + if (clp != old)
> clp->cl_preserve_clid = true;
> + nfs_put_client(clp);
> + if (clp != old)
> clp = old;
> - }
>

Applied, but I cleaned it up by replacing the last 2 lines with an equivalent ?return old?...

--
Trond Myklebust
Linux NFS client maintainer

2014-01-21 15:04:21

by Weston Andros Adamson

Subject: Re: [PATCH 1/2] nfs4: fix discover_server_trunking use after free

On Jan 20, 2014, at 6:32 PM, Trond Myklebust <[email protected]> wrote:

>
> On Jan 19, 2014, at 20:45, Weston Andros Adamson <[email protected]> wrote:
>
>> If clp is new (cl_count = 1) and it matches another client in
>> nfs4_discover_server_trunking, the nfs_put_client will free clp before
>> ->cl_preserve_clid is set.
>>
>> Cc: [email protected] # 3.7+
>> Signed-off-by: Weston Andros Adamson <[email protected]>
>> ---
>> fs/nfs/nfs4client.c | 7 ++++---
>> 1 file changed, 4 insertions(+), 3 deletions(-)
>>
>> diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
>> index c1b7a80..0f9b772 100644
>> --- a/fs/nfs/nfs4client.c
>> +++ b/fs/nfs/nfs4client.c
>> @@ -414,11 +414,12 @@ struct nfs_client *nfs4_init_client(struct nfs_client *clp,
>> error = nfs4_discover_server_trunking(clp, &old);
>> if (error < 0)
>> goto error;
>> - nfs_put_client(clp);
>> - if (clp != old) {
>> +
>> + if (clp != old)
>> clp->cl_preserve_clid = true;
>> + nfs_put_client(clp);
>> + if (clp != old)
>> clp = old;
>> - }
>>
>
> Applied, but I cleaned it up by replacing the last 2 lines with an equivalent ?return old??

Cool, I almost posted that, but thought this change was a ?cleaner? diff.

-dros

>
> --
> Trond Myklebust
> Linux NFS client maintainer
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
> the body of a message to [email protected]
> More majordomo info at http://vger.kernel.org/majordomo-info.html