Revision c68a027c05709330fe5b2f50c50d5fa02124b5d8 authored by Benjamin Coddington on 20 November 2015, 14:56:20 UTC, committed by Trond Myklebust on 24 November 2015, 02:59:42 UTC
If clp->cl_cb_ident is zero, then nfs_cb_idr_remove_locked() skips removing
it when the nfs_client is freed. A decoding or server bug can then find
and try to put that first nfs_client which would lead to a crash.
Signed-off-by: Benjamin Coddington <bcodding@redhat.com>
Fixes: d6870312659d ("nfs4client: convert to idr_alloc()")
Cc: stable@vger.kernel.org
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
1 parent 91ab4b4
| File | Mode | Size |
|---|---|---|
| Documentation | ||
| arch | ||
| block | ||
| certs | ||
| crypto | ||
| drivers | ||
| firmware | ||
| fs | ||
| include | ||
| init | ||
| ipc | ||
| kernel | ||
| lib | ||
| mm | ||
| net | ||
| samples | ||
| scripts | ||
| security | ||
| sound | ||
| tools | ||
| usr | ||
| virt | ||
| .get_maintainer.ignore | -rw-r--r-- | 31 bytes |
| .gitignore | -rw-r--r-- | 1.2 KB |
| .mailmap | -rw-r--r-- | 5.4 KB |
| COPYING | -rw-r--r-- | 18.3 KB |
| CREDITS | -rw-r--r-- | 94.9 KB |
| Kbuild | -rw-r--r-- | 2.6 KB |
| Kconfig | -rw-r--r-- | 252 bytes |
| MAINTAINERS | -rw-r--r-- | 328.3 KB |
| Makefile | -rw-r--r-- | 53.5 KB |
| README | -rw-r--r-- | 18.2 KB |
| REPORTING-BUGS | -rw-r--r-- | 7.3 KB |
Computing file changes ...
