Re: [PATCH 1/2] nfs4: fix discover_server_trunking use after free

[Trond Myklebust <trond.myklebust@primarydata.com>]

On Jan 19, 2014, at 20:45, Weston Andros Adamson <dros@primarydata.com> wrote:

> If clp is new (cl_count = 1) and it matches another client in
> nfs4_discover_server_trunking, the nfs_put_client will free clp before
> ->cl_preserve_clid is set.
> 
> Cc: stable@vger.kernel.org # 3.7+
> Signed-off-by: Weston Andros Adamson <dros@primarydata.com>
> ---
> fs/nfs/nfs4client.c | 7 ++++---
> 1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
> index c1b7a80..0f9b772 100644
> --- a/fs/nfs/nfs4client.c
> +++ b/fs/nfs/nfs4client.c
> @@ -414,11 +414,12 @@ struct nfs_client *nfs4_init_client(struct nfs_client *clp,
> 	error = nfs4_discover_server_trunking(clp, &old);
> 	if (error < 0)
> 		goto error;
> -	nfs_put_client(clp);
> -	if (clp != old) {
> +
> +	if (clp != old)
> 		clp->cl_preserve_clid = true;
> +	nfs_put_client(clp);
> +	if (clp != old)
> 		clp = old;
> -	}
> 

Applied, but I cleaned it up by replacing the last 2 lines with an equivalent ‘return old’...

--
Trond Myklebust
Linux NFS client maintainer