Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c9ce2283 authored by Greg Banks's avatar Greg Banks Committed by Linus Torvalds
Browse files

[PATCH] Fix a free-wrong-pointer bug in nfs/acl server. 



Due to type confusion, when an nfsacl verison 2 'ACCESS' request
finishes and tries to clean up, it calls fh_put on entiredly the
wrong thing and this can cause an oops.

Signed-off-by: default avatarNeil Brown <neilb@suse.de>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 575d5e72

fs/nfsd/nfs2acl.c

+12 −5
Original line number Diff line number Diff line
@@ -287,8 +287,15 @@ static int nfsaclsvc_release_getacl(struct svc_rqst *rqstp, __be32 *p, 
	return 1;

}



static int nfsaclsvc_release_fhandle(struct svc_rqst *rqstp, __be32 *p,

		struct nfsd_fhandle *resp)

static int nfsaclsvc_release_attrstat(struct svc_rqst *rqstp, __be32 *p,

		struct nfsd_attrstat *resp)

{

	fh_put(&resp->fh);

	return 1;

}



static int nfsaclsvc_release_access(struct svc_rqst *rqstp, __be32 *p,

               struct nfsd3_accessres *resp)

{

       fh_put(&resp->fh);

       return 1;
@@ -322,9 +329,9 @@ struct nfsd3_voidargs { int dummy; }; 
static struct svc_procedure		nfsd_acl_procedures2[] = {

  PROC(null,	void,		void,		void,	  RC_NOCACHE, ST),

  PROC(getacl,	getacl,		getacl,		getacl,	  RC_NOCACHE, ST+1+2*(1+ACL)),

  PROC(setacl,	setacl,		attrstat,	fhandle,  RC_NOCACHE, ST+AT),

  PROC(getattr, fhandle,	attrstat,	fhandle,  RC_NOCACHE, ST+AT),

  PROC(access,	access,		access,		fhandle,  RC_NOCACHE, ST+AT+1),

  PROC(setacl,	setacl,		attrstat,	attrstat, RC_NOCACHE, ST+AT),

  PROC(getattr, fhandle,	attrstat,	attrstat, RC_NOCACHE, ST+AT),

  PROC(access,	access,		access,		access,   RC_NOCACHE, ST+AT+1),

};



struct svc_version	nfsd_acl_version2 = {