Revision c68a027c05709330fe5b2f50c50d5fa02124b5d8 authored by Benjamin Coddington on 20 November 2015, 14:56:20 UTC, committed by Trond Myklebust on 24 November 2015, 02:59:42 UTC
If clp->cl_cb_ident is zero, then nfs_cb_idr_remove_locked() skips removing it when the nfs_client is freed. A decoding or server bug can then find and try to put that first nfs_client which would lead to a crash. Signed-off-by: Benjamin Coddington <bcodding@redhat.com> Fixes: d6870312659d ("nfs4client: convert to idr_alloc()") Cc: stable@vger.kernel.org Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
1 parent 91ab4b4
File | Mode | Size |
---|---|---|
6lowpan | ||
802 | ||
8021q | ||
9p | ||
appletalk | ||
atm | ||
ax25 | ||
batman-adv | ||
bluetooth | ||
bridge | ||
caif | ||
can | ||
ceph | ||
core | ||
dcb | ||
dccp | ||
decnet | ||
dns_resolver | ||
dsa | ||
ethernet | ||
hsr | ||
ieee802154 | ||
ipv4 | ||
ipv6 | ||
ipx | ||
irda | ||
iucv | ||
key | ||
l2tp | ||
l3mdev | ||
lapb | ||
llc | ||
mac80211 | ||
mac802154 | ||
mpls | ||
netfilter | ||
netlabel | ||
netlink | ||
netrom | ||
nfc | ||
openvswitch | ||
packet | ||
phonet | ||
rds | ||
rfkill | ||
rose | ||
rxrpc | ||
sched | ||
sctp | ||
sunrpc | ||
switchdev | ||
tipc | ||
unix | ||
vmw_vsock | ||
wimax | ||
wireless | ||
x25 | ||
xfrm | ||
Kconfig | -rw-r--r-- | 12.1 KB |
Makefile | -rw-r--r-- | 2.2 KB |
compat.c | -rw-r--r-- | 23.9 KB |
socket.c | -rw-r--r-- | 79.6 KB |
sysctl_net.c | -rw-r--r-- | 2.9 KB |
Computing file changes ...