mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-01 06:33:07 +00:00
NFSD: Fix potential use-after-free in nfsd_file_put()
[ Upstream commitb6c71c66b0
] nfsd_file_put_noref() can free @nf, so don't dereference @nf immediately upon return from nfsd_file_put_noref(). Suggested-by: Trond Myklebust <trondmy@hammerspace.com> Fixes:999397926a
("nfsd: Clean up nfsd_file_put()") Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
4e2e17a8fb
commit
333dcc94eb
1 changed files with 5 additions and 4 deletions
|
@ -306,11 +306,12 @@ nfsd_file_put(struct nfsd_file *nf)
|
|||
if (test_bit(NFSD_FILE_HASHED, &nf->nf_flags) == 0) {
|
||||
nfsd_file_flush(nf);
|
||||
nfsd_file_put_noref(nf);
|
||||
} else {
|
||||
} else if (nf->nf_file) {
|
||||
nfsd_file_put_noref(nf);
|
||||
if (nf->nf_file)
|
||||
nfsd_file_schedule_laundrette();
|
||||
}
|
||||
} else
|
||||
nfsd_file_put_noref(nf);
|
||||
|
||||
if (atomic_long_read(&nfsd_filecache_count) >= NFSD_FILE_LRU_LIMIT)
|
||||
nfsd_file_gc();
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue