diff options
| author | NeilBrown <neilb@suse.de> | 2020-05-09 07:25:11 +1000 |
|---|---|---|
| committer | Trond Myklebust <trond.myklebust@hammerspace.com> | 2020-05-10 19:44:56 -0400 |
| commit | 31e9a7f353526bbe53165a292f8ea9695ead3168 (patch) | |
| tree | 4339dc18ed5b5290b666579f6c92f6167f14043e /fs | |
| parent | 2ef96a5bb12be62ef75b5828c0aab838ebb29cb8 (diff) | |
SUNRPC: fix use-after-free in rpc_free_client_work()
Parts of rpc_free_client() were recently moved to
a separate rpc_free_clent_work(). This introduced
a use-after-free as rpc_clnt_remove_pipedir() calls
rpc_net_ns(), and that uses clnt->cl_xprt which has already
been freed.
So move the call to xprt_put() after the call to
rpc_clnt_remove_pipedir().
Reported-by: syzbot+22b5ef302c7c40d94ea8@syzkaller.appspotmail.com
Fixes: 7c4310ff5642 ("SUNRPC: defer slow parts of rpc_free_client() to a workqueue.")
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Diffstat (limited to 'fs')
0 files changed, 0 insertions, 0 deletions