Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3942302e authored by NeilBrown's avatar NeilBrown Committed by J. Bruce Fields
Browse files

sunrpc: svc_sock_names should hold ref to socket being closed. 



Currently svc_sock_names calls svc_close_xprt on a svc_sock to
which it does not own a reference.
As soon as svc_close_xprt sets XPT_CLOSE, the socket could be
freed by a separate thread (though this is a very unlikely race).

It is safer to hold a reference while calling svc_close_xprt.

Signed-off-by: default avatarNeilBrown <neilb@suse.de>
Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
parent 7c96aef7

net/sunrpc/svcsock.c

+6 −4
Original line number Diff line number Diff line
@@ -324,19 +324,21 @@ int svc_sock_names(struct svc_serv *serv, char *buf, const size_t buflen, 
			len = onelen;

			break;

		}

		if (toclose && strcmp(toclose, buf + len) == 0)

		if (toclose && strcmp(toclose, buf + len) == 0) {

			closesk = svsk;

		else

			svc_xprt_get(&closesk->sk_xprt);

		} else

			len += onelen;

	}

	spin_unlock_bh(&serv->sv_lock);



	if (closesk)

	if (closesk) {

		/* Should unregister with portmap, but you cannot

		 * unregister just one protocol...

		 */

		svc_close_xprt(&closesk->sk_xprt);

	else if (toclose)

		svc_xprt_put(&closesk->sk_xprt);

	} else if (toclose)

		return -ENOENT;

	return len;

}