aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorGreg Banks <gnb@sgi.com>2007-02-19 18:12:34 -0500
committerLinus Torvalds <torvalds@woody.linux-foundation.org>2007-02-19 19:13:28 -0500
commitc9ce228306fda4448f5f495b4f36c07956f45acd (patch)
tree1af8af646a209757f1f1af4c2de590e8027b779d
parent575d5e72aab57beb6d5fa2a7d66be9fc681a5e00 (diff)
[PATCH] Fix a free-wrong-pointer bug in nfs/acl server.
Due to type confusion, when an nfsacl verison 2 'ACCESS' request finishes and tries to clean up, it calls fh_put on entiredly the wrong thing and this can cause an oops. Signed-off-by: Neil Brown <neilb@suse.de> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-rw-r--r--fs/nfsd/nfs2acl.c17
1 files changed, 12 insertions, 5 deletions
diff --git a/fs/nfsd/nfs2acl.c b/fs/nfsd/nfs2acl.c
index edde5dc5f796..b61742885011 100644
--- a/fs/nfsd/nfs2acl.c
+++ b/fs/nfsd/nfs2acl.c
@@ -287,13 +287,20 @@ static int nfsaclsvc_release_getacl(struct svc_rqst *rqstp, __be32 *p,
287 return 1; 287 return 1;
288} 288}
289 289
290static int nfsaclsvc_release_fhandle(struct svc_rqst *rqstp, __be32 *p, 290static int nfsaclsvc_release_attrstat(struct svc_rqst *rqstp, __be32 *p,
291 struct nfsd_fhandle *resp) 291 struct nfsd_attrstat *resp)
292{ 292{
293 fh_put(&resp->fh); 293 fh_put(&resp->fh);
294 return 1; 294 return 1;
295} 295}
296 296
297static int nfsaclsvc_release_access(struct svc_rqst *rqstp, __be32 *p,
298 struct nfsd3_accessres *resp)
299{
300 fh_put(&resp->fh);
301 return 1;
302}
303
297#define nfsaclsvc_decode_voidargs NULL 304#define nfsaclsvc_decode_voidargs NULL
298#define nfsaclsvc_encode_voidres NULL 305#define nfsaclsvc_encode_voidres NULL
299#define nfsaclsvc_release_void NULL 306#define nfsaclsvc_release_void NULL
@@ -322,9 +329,9 @@ struct nfsd3_voidargs { int dummy; };
322static struct svc_procedure nfsd_acl_procedures2[] = { 329static struct svc_procedure nfsd_acl_procedures2[] = {
323 PROC(null, void, void, void, RC_NOCACHE, ST), 330 PROC(null, void, void, void, RC_NOCACHE, ST),
324 PROC(getacl, getacl, getacl, getacl, RC_NOCACHE, ST+1+2*(1+ACL)), 331 PROC(getacl, getacl, getacl, getacl, RC_NOCACHE, ST+1+2*(1+ACL)),
325 PROC(setacl, setacl, attrstat, fhandle, RC_NOCACHE, ST+AT), 332 PROC(setacl, setacl, attrstat, attrstat, RC_NOCACHE, ST+AT),
326 PROC(getattr, fhandle, attrstat, fhandle, RC_NOCACHE, ST+AT), 333 PROC(getattr, fhandle, attrstat, attrstat, RC_NOCACHE, ST+AT),
327 PROC(access, access, access, fhandle, RC_NOCACHE, ST+AT+1), 334 PROC(access, access, access, access, RC_NOCACHE, ST+AT+1),
328}; 335};
329 336
330struct svc_version nfsd_acl_version2 = { 337struct svc_version nfsd_acl_version2 = {