Re: [patch] NFS: null dereference in dev_remove()

[Stanislav Kinsbursky <skinsbursky@parallels.com>]

13.03.2012 21:18, Dan Carpenter пишет:
> In commit 5ffaf85541 "NFS: replace global bl_wq with per-net one" we
> made "msg" a pointer instead of a struct stored in stack memory.  But we
> forgot to change the memset() here so we're still clearing stack memory
> instead clearing the struct like we intended.  It will lead to a kernel
> crash.
>
> Signed-off-by: Dan Carpenter<dan.carpenter@oracle.com>
>
> diff --git a/fs/nfs/blocklayout/blocklayoutdm.c b/fs/nfs/blocklayout/blocklayoutdm.c
> index 30fc22a..737d839 100644
> --- a/fs/nfs/blocklayout/blocklayoutdm.c
> +++ b/fs/nfs/blocklayout/blocklayoutdm.c
> @@ -54,7 +54,7 @@ static void dev_remove(struct net *net, dev_t dev)
>   	dprintk("Entering %s\n", __func__);
>
>   	bl_pipe_msg.bl_wq =&nn->bl_wq;
> -	memset(&msg, 0, sizeof(*msg));
> +	memset(msg, 0, sizeof(*msg));
>   	msg->data = kzalloc(1 + sizeof(bl_umount_request), GFP_NOFS);
>   	if (!msg->data)
>   		goto out;

Thanks, Dan!

-- 
Best regards,
Stanislav Kinsbursky