Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-12-26 12:52:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

NFSd: set nfsd_serv to NULL after service destruction

Browse Source 
In nfsd_destroy():

	if (destroy)
		svc_shutdown_net(nfsd_serv, net);
	svc_destroy(nfsd_server);

svc_shutdown_net(nfsd_serv, net) calls nfsd_last_thread(), which sets
nfsd_serv to NULL, causing a NULL dereference on the following line.

Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
This commit is contained in:
Stanislav Kinsbursky 2012-07-03 16:46:41 +04:00 committed by J. Bruce Fields
parent 19f7e2ca44
commit 57c8b13e3c
2 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
fs/nfsd/nfsd.h
View File

@ -82,6 +82,8 @@ static inline void nfsd_destroy(struct net *net)
if (destroy) if (destroy)
svc_shutdown_net(nfsd_serv, net); svc_shutdown_net(nfsd_serv, net);
svc_destroy(nfsd_serv); svc_destroy(nfsd_serv);
if (destroy)
nfsd_serv = NULL;
} }
#if defined(CONFIG_NFSD_V2_ACL) || defined(CONFIG_NFSD_V3_ACL) #if defined(CONFIG_NFSD_V2_ACL) || defined(CONFIG_NFSD_V3_ACL)

10
fs/nfsd/nfssvc.c
View File

@ -254,8 +254,6 @@ static void nfsd_shutdown(void)
static void nfsd_last_thread(struct svc_serv *serv, struct net *net) static void nfsd_last_thread(struct svc_serv *serv, struct net *net)
{ {
/* When last nfsd thread exits we need to do some clean-up */
nfsd_serv = NULL;
nfsd_shutdown(); nfsd_shutdown();
svc_rpcb_cleanup(serv, net); svc_rpcb_cleanup(serv, net);
@ -332,6 +330,7 @@ static int nfsd_get_default_max_blksize(void)
int nfsd_create_serv(void) int nfsd_create_serv(void)
{ {
int error; int error;
struct net *net = current->nsproxy->net_ns;
WARN_ON(!mutex_is_locked(&nfsd_mutex)); WARN_ON(!mutex_is_locked(&nfsd_mutex));
if (nfsd_serv) { if (nfsd_serv) {
@ -346,7 +345,7 @@ int nfsd_create_serv(void)
if (nfsd_serv == NULL) if (nfsd_serv == NULL)
return -ENOMEM; return -ENOMEM;
error = svc_bind(nfsd_serv, current->nsproxy->net_ns); error = svc_bind(nfsd_serv, net);
if (error < 0) { if (error < 0) {
svc_destroy(nfsd_serv); svc_destroy(nfsd_serv);
return error; return error;
@ -557,12 +556,13 @@ nfsd(void *vrqstp)
nfsdstats.th_cnt --; nfsdstats.th_cnt --;
out: out:
if (rqstp->rq_server->sv_nrthreads == 1) rqstp->rq_server = NULL;
svc_shutdown_net(rqstp->rq_server, &init_net);
/* Release the thread */ /* Release the thread */
svc_exit_thread(rqstp); svc_exit_thread(rqstp);
nfsd_destroy(&init_net);
/* Release module */ /* Release module */
mutex_unlock(&nfsd_mutex); mutex_unlock(&nfsd_mutex);
module_put_and_exit(0); module_put_and_exit(0);