aboutsummaryrefslogtreecommitdiffstats
path: root/net/sunrpc/rpcb_clnt.c
diff options
context:
space:
mode:
authorTrond Myklebust <Trond.Myklebust@netapp.com>2008-07-07 12:18:52 -0400
committerTrond Myklebust <Trond.Myklebust@netapp.com>2008-07-08 15:23:00 -0400
commit0d3a34b48c87a374b37d7a21a60d257d076484f3 (patch)
treeb3b95c5855e25c5693d505bf74f9c5f7eccde8dc /net/sunrpc/rpcb_clnt.c
parent2aac05a91971fbd1bf6cbed78b8731eb7454b9b7 (diff)
SUNRPC: Fix a double-free in rpcbind
It is wrong to be freeing up the rpcbind arguments if the call to rpcb_call_async() fails, since they should already have been freed up by rpcb_map_release(). Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Diffstat (limited to 'net/sunrpc/rpcb_clnt.c')
-rw-r--r--net/sunrpc/rpcb_clnt.c6
1 files changed, 2 insertions, 4 deletions
diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c
index 0517967a68bf..21c698d7b774 100644
--- a/net/sunrpc/rpcb_clnt.c
+++ b/net/sunrpc/rpcb_clnt.c
@@ -365,18 +365,16 @@ void rpcb_getport_async(struct rpc_task *task)
365 rpc_release_client(rpcb_clnt); 365 rpc_release_client(rpcb_clnt);
366 if (IS_ERR(child)) { 366 if (IS_ERR(child)) {
367 status = -EIO; 367 status = -EIO;
368 /* rpcb_map_release() has freed the arguments */
368 dprintk("RPC: %5u %s: rpc_run_task failed\n", 369 dprintk("RPC: %5u %s: rpc_run_task failed\n",
369 task->tk_pid, __func__); 370 task->tk_pid, __func__);
370 goto bailout; 371 goto bailout_nofree;
371 } 372 }
372 rpc_put_task(child); 373 rpc_put_task(child);
373 374
374 task->tk_xprt->stat.bind_count++; 375 task->tk_xprt->stat.bind_count++;
375 return; 376 return;
376 377
377bailout:
378 kfree(map);
379 xprt_put(xprt);
380bailout_nofree: 378bailout_nofree:
381 rpcb_wake_rpcbind_waiters(xprt, status); 379 rpcb_wake_rpcbind_waiters(xprt, status);
382bailout_nowake: 380bailout_nowake: