diff options
author | Trond Myklebust <Trond.Myklebust@netapp.com> | 2008-07-07 12:18:52 -0400 |
---|---|---|
committer | Trond Myklebust <Trond.Myklebust@netapp.com> | 2008-07-08 15:23:00 -0400 |
commit | 0d3a34b48c87a374b37d7a21a60d257d076484f3 (patch) | |
tree | b3b95c5855e25c5693d505bf74f9c5f7eccde8dc /net | |
parent | 2aac05a91971fbd1bf6cbed78b8731eb7454b9b7 (diff) |
SUNRPC: Fix a double-free in rpcbind
It is wrong to be freeing up the rpcbind arguments if the call to
rpcb_call_async() fails, since they should already have been freed up by
rpcb_map_release().
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Diffstat (limited to 'net')
-rw-r--r-- | net/sunrpc/rpcb_clnt.c | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c index 0517967a68b..21c698d7b77 100644 --- a/net/sunrpc/rpcb_clnt.c +++ b/net/sunrpc/rpcb_clnt.c | |||
@@ -365,18 +365,16 @@ void rpcb_getport_async(struct rpc_task *task) | |||
365 | rpc_release_client(rpcb_clnt); | 365 | rpc_release_client(rpcb_clnt); |
366 | if (IS_ERR(child)) { | 366 | if (IS_ERR(child)) { |
367 | status = -EIO; | 367 | status = -EIO; |
368 | /* rpcb_map_release() has freed the arguments */ | ||
368 | dprintk("RPC: %5u %s: rpc_run_task failed\n", | 369 | dprintk("RPC: %5u %s: rpc_run_task failed\n", |
369 | task->tk_pid, __func__); | 370 | task->tk_pid, __func__); |
370 | goto bailout; | 371 | goto bailout_nofree; |
371 | } | 372 | } |
372 | rpc_put_task(child); | 373 | rpc_put_task(child); |
373 | 374 | ||
374 | task->tk_xprt->stat.bind_count++; | 375 | task->tk_xprt->stat.bind_count++; |
375 | return; | 376 | return; |
376 | 377 | ||
377 | bailout: | ||
378 | kfree(map); | ||
379 | xprt_put(xprt); | ||
380 | bailout_nofree: | 378 | bailout_nofree: |
381 | rpcb_wake_rpcbind_waiters(xprt, status); | 379 | rpcb_wake_rpcbind_waiters(xprt, status); |
382 | bailout_nowake: | 380 | bailout_nowake: |