Commit c2dc3e5f authored by Trond Myklebust's avatar Trond Myklebust Committed by Anna Schumaker
Browse files

SUNRPC: Fix potential memory corruption 



We really should not call rpc_wake_up_queued_task_set_status() with
xprt->snd_task as an argument unless we are certain that is actually an
rpc_task.

Fixes: 0445f92c ("SUNRPC: Fix disconnection races")
Signed-off-by: default avatarTrond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: default avatarAnna Schumaker <Anna.Schumaker@Netapp.com>
parent d6236a98

include/linux/sunrpc/xprt.h

+1 −0
Original line number Diff line number Diff line
@@ -432,6 +432,7 @@ void xprt_release_write(struct rpc_xprt *, struct rpc_task *); 
#define XPRT_CONGESTED		(9)

#define XPRT_CWND_WAIT		(10)

#define XPRT_WRITE_SPACE	(11)

#define XPRT_SND_IS_COOKIE	(12)



static inline void xprt_set_connected(struct rpc_xprt *xprt)

{

net/sunrpc/xprt.c

+4 −2
Original line number Diff line number Diff line
@@ -775,7 +775,7 @@ void xprt_force_disconnect(struct rpc_xprt *xprt) 
	/* Try to schedule an autoclose RPC call */

	if (test_and_set_bit(XPRT_LOCKED, &xprt->state) == 0)

		queue_work(xprtiod_workqueue, &xprt->task_cleanup);

	else if (xprt->snd_task)

	else if (xprt->snd_task && !test_bit(XPRT_SND_IS_COOKIE, &xprt->state))

		rpc_wake_up_queued_task_set_status(&xprt->pending,

						   xprt->snd_task, -ENOTCONN);

	spin_unlock(&xprt->transport_lock);
@@ -866,6 +866,7 @@ bool xprt_lock_connect(struct rpc_xprt *xprt, 
		goto out;

	if (xprt->snd_task != task)

		goto out;

	set_bit(XPRT_SND_IS_COOKIE, &xprt->state);

	xprt->snd_task = cookie;

	ret = true;

out:
@@ -881,6 +882,7 @@ void xprt_unlock_connect(struct rpc_xprt *xprt, void *cookie) 
	if (!test_bit(XPRT_LOCKED, &xprt->state))

		goto out;

	xprt->snd_task =NULL;

	clear_bit(XPRT_SND_IS_COOKIE, &xprt->state);

	xprt->ops->release_xprt(xprt, NULL);

	xprt_schedule_autodisconnect(xprt);

out: