diff options
| author | Trond Myklebust <Trond.Myklebust@netapp.com> | 2010-03-19 19:36:22 (GMT) |
|---|---|---|
| committer | Trond Myklebust <Trond.Myklebust@netapp.com> | 2010-03-22 09:32:44 (GMT) |
| commit | c9acb42ef1904d15d0fb315061cefbe638f67f3a (patch) | |
| tree | 7c94dff168dfc90a279990cb2860cce626ae76a3 /net/sunrpc/xprtsock.c | |
| parent | cdead7cf12896c0e50a8be2e52de52c364603095 (diff) | |
| download | linux-fsl-qoriq-c9acb42ef1904d15d0fb315061cefbe638f67f3a.tar.xz | |
SUNRPC: Fix a use after free bug with the NFSv4.1 backchannel
The ->release_request() callback was designed to allow the transport layer
to do housekeeping after the RPC call is done. It cannot be used to free
the request itself, and doing so leads to a use-after-free bug in
xprt_release().
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Diffstat (limited to 'net/sunrpc/xprtsock.c')
| -rw-r--r-- | net/sunrpc/xprtsock.c | 3 |
1 files changed, 0 insertions, 3 deletions
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c index e4839c0..9847c30 100644 --- a/net/sunrpc/xprtsock.c +++ b/net/sunrpc/xprtsock.c @@ -2251,9 +2251,6 @@ static struct rpc_xprt_ops xs_tcp_ops = { .buf_free = rpc_free, .send_request = xs_tcp_send_request, .set_retrans_timeout = xprt_set_retrans_timeout_def, -#if defined(CONFIG_NFS_V4_1) - .release_request = bc_release_request, -#endif /* CONFIG_NFS_V4_1 */ .close = xs_tcp_close, .destroy = xs_destroy, .print_stats = xs_tcp_print_stats, |