diff options
| author | Trond Myklebust <Trond.Myklebust@netapp.com> | 2007-02-05 12:33:23 -0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2007-03-09 10:50:29 -0800 |
| commit | 610a0848ef255175fa9552406b8582c1df7593bb (patch) | |
| tree | 9351c1af27113b6f45f02b05438c29319fd7cec3 /fs | |
| parent | af2fec7364857f677b3f9ee3617ee9fbc849e6bd (diff) | |
NLM: Fix double free in __nlm_async_call
rpc_call_async() will always call rpc_release_calldata(), so it is an
error for __nlm_async_call() to do so as well.
Addresses http://bugzilla.kernel.org/show_bug.cgi?id=7923
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Cc: Jan "Yenya" Kasprzak <kas@fi.muni.cz>
Cc: Neil Brown <neilb@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/lockd/clntproc.c | 9 | ||||
| -rw-r--r-- | fs/lockd/svclock.c | 4 |
2 files changed, 4 insertions, 9 deletions
diff --git a/fs/lockd/clntproc.c b/fs/lockd/clntproc.c index 0b4acc1c5e7..a5c019e1a44 100644 --- a/fs/lockd/clntproc.c +++ b/fs/lockd/clntproc.c @@ -361,7 +361,6 @@ static int __nlm_async_call(struct nlm_rqst *req, u32 proc, struct rpc_message * { struct nlm_host *host = req->a_host; struct rpc_clnt *clnt; - int status = -ENOLCK; dprintk("lockd: call procedure %d on %s (async)\n", (int)proc, host->h_name); @@ -373,12 +372,10 @@ static int __nlm_async_call(struct nlm_rqst *req, u32 proc, struct rpc_message * msg->rpc_proc = &clnt->cl_procinfo[proc]; /* bootstrap and kick off the async RPC call */ - status = rpc_call_async(clnt, msg, RPC_TASK_ASYNC, tk_ops, req); - if (status == 0) - return 0; + return rpc_call_async(clnt, msg, RPC_TASK_ASYNC, tk_ops, req); out_err: - nlm_release_call(req); - return status; + tk_ops->rpc_release(req); + return -ENOLCK; } int nlm_async_call(struct nlm_rqst *req, u32 proc, const struct rpc_call_ops *tk_ops) diff --git a/fs/lockd/svclock.c b/fs/lockd/svclock.c index c7db0a5bccd..cf51f849e76 100644 --- a/fs/lockd/svclock.c +++ b/fs/lockd/svclock.c @@ -593,9 +593,7 @@ callback: /* Call the client */ kref_get(&block->b_count); - if (nlm_async_call(block->b_call, NLMPROC_GRANTED_MSG, - &nlmsvc_grant_ops) < 0) - nlmsvc_release_block(block); + nlm_async_call(block->b_call, NLMPROC_GRANTED_MSG, &nlmsvc_grant_ops); } /* |