Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 54cc533a authored by Trond Myklebust's avatar Trond Myklebust
Browse files

RPC: Fix double free in portmapper code 



rpc_run_task is guaranteed to always call ->rpc_release.

Signed-off-by: default avatarTrond Myklebust <Trond.Myklebust@netapp.com>
parent a995e9eb

net/sunrpc/pmap_clnt.c

+5 −3
Original line number Original line Diff line number Diff line
@@ -62,7 +62,10 @@ static inline void pmap_map_free(struct portmap_args *map) 




static void pmap_map_release(void *data)

static void pmap_map_release(void *data)

{

{

	pmap_map_free(data);

	struct portmap_args *map = data;



	xprt_put(map->pm_xprt);

	pmap_map_free(map);

}

}





static const struct rpc_call_ops pmap_getport_ops = {

static const struct rpc_call_ops pmap_getport_ops = {
@@ -133,7 +136,7 @@ void rpc_getport(struct rpc_task *task) 
	status = -EIO;

	status = -EIO;

	child = rpc_run_task(pmap_clnt, RPC_TASK_ASYNC, &pmap_getport_ops, map);

	child = rpc_run_task(pmap_clnt, RPC_TASK_ASYNC, &pmap_getport_ops, map);

	if (IS_ERR(child))

	if (IS_ERR(child))

		goto bailout;

		goto bailout_nofree;

	rpc_put_task(child);

	rpc_put_task(child);





	task->tk_xprt->stat.bind_count++;

	task->tk_xprt->stat.bind_count++;
@@ -222,7 +225,6 @@ static void pmap_getport_done(struct rpc_task *child, void *data) 
			child->tk_pid, status, map->pm_port);

			child->tk_pid, status, map->pm_port);





	pmap_wake_portmap_waiters(xprt, status);

	pmap_wake_portmap_waiters(xprt, status);

	xprt_put(xprt);

}

}





/**

/**