diff options
| author | Trond Myklebust <trond.myklebust@primarydata.com> | 2014-03-26 13:24:37 -0700 |
|---|---|---|
| committer | Trond Myklebust <trond.myklebust@primarydata.com> | 2014-03-28 20:12:10 -0400 |
| commit | e911b8158ee1def8153849b1641b736026b036e0 (patch) | |
| tree | b9c302ffd9e9580afe59b3d56b2380ea9e76204e /drivers/mtd/maps/lantiq-flash.c | |
| parent | 494314c415e2d3b308f57c9245ae6525166c70b8 (diff) | |
| download | op-kernel-dev-e911b8158ee1def8153849b1641b736026b036e0.zip op-kernel-dev-e911b8158ee1def8153849b1641b736026b036e0.tar.gz | |
NFSv4: Fix a use-after-free problem in open()
If we interrupt the nfs4_wait_for_completion_rpc_task() call in
nfs4_run_open_task(), then we don't prevent the RPC call from
completing. So freeing up the opendata->f_attr.mdsthreshold
in the error path in _nfs4_do_open() leads to a use-after-free
when the XDR decoder tries to decode the mdsthreshold information
from the server.
Fixes: 82be417aa37c0 (NFSv4.1 cache mdsthreshold values on OPEN)
Tested-by: Steve Dickson <SteveD@redhat.com>
Cc: stable@vger.kernel.org # 3.5+
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Diffstat (limited to 'drivers/mtd/maps/lantiq-flash.c')
0 files changed, 0 insertions, 0 deletions
