nfsd: fix auth_domain reference leak on nlm operations
This was noticed by users who performed more than 2^32 lock operations and hence made this counter overflow (eventually leading to use-after-free's). Setting rq_client to NULL here means that it won't later get auth_domain_put() when it should be. Appears to have been introduced in 2.5.42 by "[PATCH] kNFSd: Move auth domain lookup into svcauth" which moved most of the rq_client handling to common svcauth code, but left behind this one line. Cc: Neil Brown <neilb@suse.de> Cc: stable@kernel.org Signed-off-by: J. Bruce Fields <bfields@redhat.com>
This commit is contained in:
parent
4be34b9d69
commit
954032d252
|
@ -38,7 +38,6 @@ nlm_fopen(struct svc_rqst *rqstp, struct nfs_fh *f, struct file **filp)
|
||||||
exp_readlock();
|
exp_readlock();
|
||||||
nfserr = nfsd_open(rqstp, &fh, S_IFREG, NFSD_MAY_LOCK, filp);
|
nfserr = nfsd_open(rqstp, &fh, S_IFREG, NFSD_MAY_LOCK, filp);
|
||||||
fh_put(&fh);
|
fh_put(&fh);
|
||||||
rqstp->rq_client = NULL;
|
|
||||||
exp_readunlock();
|
exp_readunlock();
|
||||||
/* We return nlm error codes as nlm doesn't know
|
/* We return nlm error codes as nlm doesn't know
|
||||||
* about nfsd, but nfsd does know about nlm..
|
* about nfsd, but nfsd does know about nlm..
|
||||||
|
|
Loading…
Reference in a new issue