diff options
| author | Trond Myklebust <trond.myklebust@primarydata.com> | 2014-03-26 13:24:37 -0700 |
|---|---|---|
| committer | Jiri Slaby <jslaby@suse.cz> | 2014-05-15 09:55:05 +0200 |
| commit | ca2ad538ba4734fbc3d6a03caedc68113ff0a3e9 (patch) | |
| tree | 0128bb1a4021502d21026e09e9d641870ea23966 /lib/hexdump.c | |
| parent | ef878b6e73ac392e6bad83713bfd1361c79bdbaf (diff) | |
NFSv4: Fix a use-after-free problem in open()
commit e911b8158ee1def8153849b1641b736026b036e0 upstream.
If we interrupt the nfs4_wait_for_completion_rpc_task() call in
nfs4_run_open_task(), then we don't prevent the RPC call from
completing. So freeing up the opendata->f_attr.mdsthreshold
in the error path in _nfs4_do_open() leads to a use-after-free
when the XDR decoder tries to decode the mdsthreshold information
from the server.
Fixes: 82be417aa37c0 (NFSv4.1 cache mdsthreshold values on OPEN)
Tested-by: Steve Dickson <SteveD@redhat.com>
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Diffstat (limited to 'lib/hexdump.c')
0 files changed, 0 insertions, 0 deletions