Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 57c8b13e authored by Stanislav Kinsbursky's avatar Stanislav Kinsbursky Committed by J. Bruce Fields
Browse files

NFSd: set nfsd_serv to NULL after service destruction 



In nfsd_destroy():

	if (destroy)
		svc_shutdown_net(nfsd_serv, net);
	svc_destroy(nfsd_server);

svc_shutdown_net(nfsd_serv, net) calls nfsd_last_thread(), which sets
nfsd_serv to NULL, causing a NULL dereference on the following line.

Signed-off-by: default avatarStanislav Kinsbursky <skinsbursky@parallels.com>
Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
parent 19f7e2ca

fs/nfsd/nfsd.h

+2 −0
Original line number Diff line number Diff line
@@ -82,6 +82,8 @@ static inline void nfsd_destroy(struct net *net) 
	if (destroy)

		svc_shutdown_net(nfsd_serv, net);

	svc_destroy(nfsd_serv);

	if (destroy)

		nfsd_serv = NULL;

}



#if defined(CONFIG_NFSD_V2_ACL) || defined(CONFIG_NFSD_V3_ACL)

fs/nfsd/nfssvc.c

+5 −5
Original line number Diff line number Diff line
@@ -254,8 +254,6 @@ static void nfsd_shutdown(void) 


static void nfsd_last_thread(struct svc_serv *serv, struct net *net)

{

	/* When last nfsd thread exits we need to do some clean-up */

	nfsd_serv = NULL;

	nfsd_shutdown();



	svc_rpcb_cleanup(serv, net);
@@ -332,6 +330,7 @@ static int nfsd_get_default_max_blksize(void) 
int nfsd_create_serv(void)

{

	int error;

	struct net *net = current->nsproxy->net_ns;



	WARN_ON(!mutex_is_locked(&nfsd_mutex));

	if (nfsd_serv) {
@@ -346,7 +345,7 @@ int nfsd_create_serv(void) 
	if (nfsd_serv == NULL)

		return -ENOMEM;



	error = svc_bind(nfsd_serv, current->nsproxy->net_ns);

	error = svc_bind(nfsd_serv, net);

	if (error < 0) {

		svc_destroy(nfsd_serv);

		return error;
@@ -557,12 +556,13 @@ nfsd(void *vrqstp) 
	nfsdstats.th_cnt --;



out:

	if (rqstp->rq_server->sv_nrthreads == 1)

		svc_shutdown_net(rqstp->rq_server, &init_net);

	rqstp->rq_server = NULL;



	/* Release the thread */

	svc_exit_thread(rqstp);



	nfsd_destroy(&init_net);



	/* Release module */

	mutex_unlock(&nfsd_mutex);

	module_put_and_exit(0);