[patch 079/101] RPM: fix double free in portmapper code
From: Trond Myklebust <[EMAIL PROTECTED]>
rpc_run_task is guaranteed to always call ->rpc_release.
Signed-off-by: Trond Myklebust <[EMAIL PROTECTED]>
Cc: Neil Brown <[EMAIL PROTECTED]>
Cc: Jan "Yenya" Kasprzak <[EMAIL PROTECTED]>
Signed-off-by: Andrew Morton <[EMAIL PROTECTED]>
Signed-off-by: Greg Kroah-Hartman <[EMAIL PROTECTED]>
---
net/sunrpc/pmap_clnt.c |8 +---
1 file changed, 5 insertions(+), 3 deletions(-)
--- linux-2.6.20.1.orig/net/sunrpc/pmap_clnt.c
+++ linux-2.6.20.1/net/sunrpc/pmap_clnt.c
@@ -62,7 +62,10 @@ static inline void pmap_map_free(struct
static void pmap_map_release(void *data)
{
- pmap_map_free(data);
+ struct portmap_args *map = data;
+
+ xprt_put(map->pm_xprt);
+ pmap_map_free(map);
}
static const struct rpc_call_ops pmap_getport_ops = {
@@ -133,7 +136,7 @@ void rpc_getport(struct rpc_task *task)
status = -EIO;
child = rpc_run_task(pmap_clnt, RPC_TASK_ASYNC, _getport_ops, map);
if (IS_ERR(child))
- goto bailout;
+ goto bailout_nofree;
rpc_put_task(child);
task->tk_xprt->stat.bind_count++;
@@ -222,7 +225,6 @@ static void pmap_getport_done(struct rpc
child->tk_pid, status, map->pm_port);
pmap_wake_portmap_waiters(xprt, status);
- xprt_put(xprt);
}
/**
--
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[patch 079/101] RPM: fix double free in portmapper code
From: Trond Myklebust [EMAIL PROTECTED]
rpc_run_task is guaranteed to always call -rpc_release.
Signed-off-by: Trond Myklebust [EMAIL PROTECTED]
Cc: Neil Brown [EMAIL PROTECTED]
Cc: Jan Yenya Kasprzak [EMAIL PROTECTED]
Signed-off-by: Andrew Morton [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
---
net/sunrpc/pmap_clnt.c |8 +---
1 file changed, 5 insertions(+), 3 deletions(-)
--- linux-2.6.20.1.orig/net/sunrpc/pmap_clnt.c
+++ linux-2.6.20.1/net/sunrpc/pmap_clnt.c
@@ -62,7 +62,10 @@ static inline void pmap_map_free(struct
static void pmap_map_release(void *data)
{
- pmap_map_free(data);
+ struct portmap_args *map = data;
+
+ xprt_put(map-pm_xprt);
+ pmap_map_free(map);
}
static const struct rpc_call_ops pmap_getport_ops = {
@@ -133,7 +136,7 @@ void rpc_getport(struct rpc_task *task)
status = -EIO;
child = rpc_run_task(pmap_clnt, RPC_TASK_ASYNC, pmap_getport_ops, map);
if (IS_ERR(child))
- goto bailout;
+ goto bailout_nofree;
rpc_put_task(child);
task-tk_xprt-stat.bind_count++;
@@ -222,7 +225,6 @@ static void pmap_getport_done(struct rpc
child-tk_pid, status, map-pm_port);
pmap_wake_portmap_waiters(xprt, status);
- xprt_put(xprt);
}
/**
--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
