Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2c4cdf8f authored by Andy Adamson's avatar Andy Adamson Committed by Trond Myklebust
Browse files

NFS fix cb_sequence error processing 



Always assign the cb_process_state nfs_client pointer so a processing error
in cb_sequence after the nfs_client is found and referenced returns
a non-NULL cb_process_state nfs_client and the matching nfs_put_client in
nfs4_callback_compound dereferences the client.

Signed-off-by: default avatarAndy Adamson <andros@netapp.com>
Signed-off-by: default avatarTrond Myklebust <Trond.Myklebust@netapp.com>
parent 778be232

fs/nfs/callback_proc.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -408,9 +408,9 @@ __be32 nfs4_callback_sequence(struct cb_sequenceargs *args, 
	res->csr_highestslotid = NFS41_BC_MAX_CALLBACKS - 1;

	res->csr_highestslotid = NFS41_BC_MAX_CALLBACKS - 1;

	res->csr_target_highestslotid = NFS41_BC_MAX_CALLBACKS - 1;

	res->csr_target_highestslotid = NFS41_BC_MAX_CALLBACKS - 1;

	nfs4_cb_take_slot(clp);

	nfs4_cb_take_slot(clp);

	cps->clp = clp; /* put in nfs4_callback_compound */





out:

out:

	cps->clp = clp; /* put in nfs4_callback_compound */

	for (i = 0; i < args->csa_nrclists; i++)

	for (i = 0; i < args->csa_nrclists; i++)

		kfree(args->csa_rclists[i].rcl_refcalls);

		kfree(args->csa_rclists[i].rcl_refcalls);

	kfree(args->csa_rclists);

	kfree(args->csa_rclists);