mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-27 19:29:37 +00:00
SUNRPC: Fix potential memory scribble in xprt_free_bc_request()
The call to xprt_free_allocation() will call list_del() on req->rq_bc_pa_list, which is not attached to a list. This patch moves the list_del() out of xprt_free_allocation() and into those callers that need it. Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
This commit is contained in:
parent
06ea0bfe6e
commit
628356791b
1 changed files with 4 additions and 2 deletions
|
@ -64,7 +64,6 @@ static void xprt_free_allocation(struct rpc_rqst *req)
|
||||||
free_page((unsigned long)xbufp->head[0].iov_base);
|
free_page((unsigned long)xbufp->head[0].iov_base);
|
||||||
xbufp = &req->rq_snd_buf;
|
xbufp = &req->rq_snd_buf;
|
||||||
free_page((unsigned long)xbufp->head[0].iov_base);
|
free_page((unsigned long)xbufp->head[0].iov_base);
|
||||||
list_del(&req->rq_bc_pa_list);
|
|
||||||
kfree(req);
|
kfree(req);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -168,8 +167,10 @@ int xprt_setup_backchannel(struct rpc_xprt *xprt, unsigned int min_reqs)
|
||||||
/*
|
/*
|
||||||
* Memory allocation failed, free the temporary list
|
* Memory allocation failed, free the temporary list
|
||||||
*/
|
*/
|
||||||
list_for_each_entry_safe(req, tmp, &tmp_list, rq_bc_pa_list)
|
list_for_each_entry_safe(req, tmp, &tmp_list, rq_bc_pa_list) {
|
||||||
|
list_del(&req->rq_bc_pa_list);
|
||||||
xprt_free_allocation(req);
|
xprt_free_allocation(req);
|
||||||
|
}
|
||||||
|
|
||||||
dprintk("RPC: setup backchannel transport failed\n");
|
dprintk("RPC: setup backchannel transport failed\n");
|
||||||
return -ENOMEM;
|
return -ENOMEM;
|
||||||
|
@ -198,6 +199,7 @@ void xprt_destroy_backchannel(struct rpc_xprt *xprt, unsigned int max_reqs)
|
||||||
xprt_dec_alloc_count(xprt, max_reqs);
|
xprt_dec_alloc_count(xprt, max_reqs);
|
||||||
list_for_each_entry_safe(req, tmp, &xprt->bc_pa_list, rq_bc_pa_list) {
|
list_for_each_entry_safe(req, tmp, &xprt->bc_pa_list, rq_bc_pa_list) {
|
||||||
dprintk("RPC: req=%p\n", req);
|
dprintk("RPC: req=%p\n", req);
|
||||||
|
list_del(&req->rq_bc_pa_list);
|
||||||
xprt_free_allocation(req);
|
xprt_free_allocation(req);
|
||||||
if (--max_reqs == 0)
|
if (--max_reqs == 0)
|
||||||
break;
|
break;
|
||||||
|
|
Loading…
Reference in a new issue