aboutsummaryrefslogtreecommitdiffstats
path: root/net/sunrpc/xprtsock.c
diff options
context:
space:
mode:
authorTrond Myklebust <Trond.Myklebust@netapp.com>2010-03-19 15:36:22 -0400
committerTrond Myklebust <Trond.Myklebust@netapp.com>2010-03-22 05:32:44 -0400
commitc9acb42ef1904d15d0fb315061cefbe638f67f3a (patch)
tree7c94dff168dfc90a279990cb2860cce626ae76a3 /net/sunrpc/xprtsock.c
parentcdead7cf12896c0e50a8be2e52de52c364603095 (diff)
SUNRPC: Fix a use after free bug with the NFSv4.1 backchannel
The ->release_request() callback was designed to allow the transport layer to do housekeeping after the RPC call is done. It cannot be used to free the request itself, and doing so leads to a use-after-free bug in xprt_release(). Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Diffstat (limited to 'net/sunrpc/xprtsock.c')
-rw-r--r--net/sunrpc/xprtsock.c3
1 files changed, 0 insertions, 3 deletions
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index e4839c07c913..9847c30b5001 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -2251,9 +2251,6 @@ static struct rpc_xprt_ops xs_tcp_ops = {
2251 .buf_free = rpc_free, 2251 .buf_free = rpc_free,
2252 .send_request = xs_tcp_send_request, 2252 .send_request = xs_tcp_send_request,
2253 .set_retrans_timeout = xprt_set_retrans_timeout_def, 2253 .set_retrans_timeout = xprt_set_retrans_timeout_def,
2254#if defined(CONFIG_NFS_V4_1)
2255 .release_request = bc_release_request,
2256#endif /* CONFIG_NFS_V4_1 */
2257 .close = xs_tcp_close, 2254 .close = xs_tcp_close,
2258 .destroy = xs_destroy, 2255 .destroy = xs_destroy,
2259 .print_stats = xs_tcp_print_stats, 2256 .print_stats = xs_tcp_print_stats,