diff options
| author | Trond Myklebust <Trond.Myklebust@netapp.com> | 2010-09-12 19:55:25 -0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2010-09-20 13:36:47 -0700 |
| commit | 661b2c51d9f019662ce1584d6def2fe2f05096da (patch) | |
| tree | 72da70406210d14e51c380b1ffc479ba95c4ca34 /net/lapb/lapb_iface.c | |
| parent | 5c41628055bec9f45fe29c8b553c6048c053236c (diff) | |
SUNRPC: Fix race corrupting rpc upcall
commit 5a67657a2e90c9e4a48518f95d4ba7777aa20fbb upstream.
If rpc_queue_upcall() adds a new upcall to the rpci->pipe list just
after rpc_pipe_release calls rpc_purge_list(), but before it calls
gss_pipe_release (as rpci->ops->release_pipe(inode)), then the latter
will free a message without deleting it from the rpci->pipe list.
We will be left with a freed object on the rpc->pipe list. Most
frequent symptoms are kernel crashes in rpc.gssd system calls on the
pipe in question.
Reported-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'net/lapb/lapb_iface.c')
0 files changed, 0 insertions, 0 deletions