Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f259613a authored by NeilBrown's avatar NeilBrown Committed by Trond Myklebust
Browse files

NFS: avoid NULL dereference in nfs_destroy_server 



In rare circumstances, nfs_clone_server() of a v2 or v3 server can get
an error between setting server->destory (to nfs_destroy_server), and
calling nfs_start_lockd (which will set server->nlm_host).

If this happens, nfs_clone_server will call nfs_free_server which
will call nfs_destroy_server and thence nlmclnt_done(NULL).  This
causes the NULL to be dereferenced.

So add a guard to only call nlmclnt_done() if ->nlm_host is not NULL.

The other guards there are irrelevant as nlm_host can only be non-NULL
if one of these flags are set - so remove those tests.  (Thanks to Trond
for this suggestion).

This is suitable for any stable kernel since 2.6.25.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarNeilBrown <neilb@suse.de>
Signed-off-by: default avatarTrond Myklebust <Trond.Myklebust@netapp.com>
parent eb96d5c9

fs/nfs/client.c

+1 −2
Original line number Diff line number Diff line
@@ -615,8 +615,7 @@ EXPORT_SYMBOL_GPL(nfs_create_rpc_client); 
 */

static void nfs_destroy_server(struct nfs_server *server)

{

	if (!(server->flags & NFS_MOUNT_LOCAL_FLOCK) ||

			!(server->flags & NFS_MOUNT_LOCAL_FCNTL))

	if (server->nlm_host)

		nlmclnt_done(server->nlm_host);

}