NFSv4: Fix a use-after-free issue with the nfs server. (5dd3177a) · Commits · e / devices / android_kernel_xiaomi_markw

fs/nfs/client.c

+21 −15

Original line number	Diff line number	Diff line
		@@ -164,15 +164,11 @@ error_0:
		return NULL;
		}

		/*
		* Destroy a shared client record
		*/
		static void nfs_free_client(struct nfs_client *clp)
		static void nfs4_shutdown_client(struct nfs_client *clp)
		{
		dprintk("--> nfs_free_client(%d)\n", clp->cl_nfsversion);

		#ifdef CONFIG_NFS_V4
		if (__test_and_clear_bit(NFS_CS_IDMAP, &clp->cl_res_state)) {
		if (__test_and_clear_bit(NFS_CS_RENEWD, &clp->cl_res_state))
		nfs4_kill_renewd(clp);
		while (!list_empty(&clp->cl_unused)) {
		struct nfs4_state_owner *sp;

		@@ -183,9 +179,19 @@ static void nfs_free_client(struct nfs_client *clp)
		kfree(sp);
		}
		BUG_ON(!list_empty(&clp->cl_state_owners));
		if (__test_and_clear_bit(NFS_CS_IDMAP, &clp->cl_res_state))
		nfs_idmap_delete(clp);
		}
		#endif
		}

		/*
		* Destroy a shared client record
		*/
		static void nfs_free_client(struct nfs_client *clp)
		{
		dprintk("--> nfs_free_client(%d)\n", clp->cl_nfsversion);

		nfs4_shutdown_client(clp);

		/* -EIO all pending I/O */
		if (!IS_ERR(clp->cl_rpcclient))

+1 −0

Original line number	Diff line number	Diff line
		@@ -121,6 +121,7 @@ nfs4_schedule_state_renewal(struct nfs_client *clp)
		__FUNCTION__, (timeout + HZ - 1) / HZ);
		cancel_delayed_work(&clp->cl_renewd);
		schedule_delayed_work(&clp->cl_renewd, timeout);
		set_bit(NFS_CS_RENEWD, &clp->cl_res_state);
		spin_unlock(&clp->cl_lock);
		}

+5 −3

Original line number	Diff line number	Diff line
		@@ -883,13 +883,15 @@ static int nfs4_get_sb(struct file_system_type *fs_type,
		goto out_free;
		}

		if (s->s_fs_info != server) {
		nfs_free_server(server);
		server = NULL;
		}

		if (!s->s_root) {
		/* initial superblock/root creation */
		s->s_flags = flags;

		nfs4_fill_super(s);
		} else {
		nfs_free_server(server);
		}

		mntroot = nfs4_get_root(s, &mntfh);

+1 −0

Original line number	Diff line number	Diff line
		@@ -19,6 +19,7 @@ struct nfs_client {
		#define NFS_CS_RPCIOD 0 /* - rpciod started */
		#define NFS_CS_CALLBACK 1 /* - callback started */
		#define NFS_CS_IDMAP 2 /* - idmap started */
		#define NFS_CS_RENEWD 3 /* - renewd started */
		struct sockaddr_in cl_addr; /* server identifier */
		char * cl_hostname; /* hostname of server */
		struct list_head cl_share_link; /* link in global client list */