Re: [PATCH 1/2] nfs4: fix discover_server_trunking use after free

Trond Myklebust
2014-01-20T23:33:01Z

On Jan 19, 2014, at 20:45, Weston Andros Adamson <dros@primarydata.com> wrote:

> If clp is new (cl_count = 1) and it matches another client in
> nfs4_discover_server_trunking, the nfs_put_client will free clp before
> ->cl_preserve_clid is set.
>
> Cc: stable@vger.kernel.org # 3.7+
> Signed-off-by: Weston Andros Adamson <dros@primarydata.com>
> ---
> fs/nfs/nfs4client.c | 7 ++++---
> 1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
> index c1b7a80..0f9b772 100644
> --- a/fs/nfs/nfs4client.c
> +++ b/fs/nfs/nfs4client.c
> @@ -414,11 +414,12 @@ struct nfs_client *nfs4_init_client(struct nfs_client *clp,
> error = nfs4_discover_server_trunking(clp, &old);
> if (error < 0)
> goto error;
> - nfs_put_client(clp);
> - if (clp != old) {
> +
> + if (clp != old)
> clp->cl_preserve_clid = true;
> + nfs_put_client(clp);
> + if (clp != old)
> clp = old;
> - }
>

Applied, but I cleaned it up by replacing the last 2 lines with an equivalent ‘return old’...

--
Trond Myklebust
Linux NFS client maintainer