diff options
| author | Trond Myklebust <Trond.Myklebust@netapp.com> | 2007-02-05 12:33:22 -0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2007-03-09 10:50:29 -0800 |
| commit | af2fec7364857f677b3f9ee3617ee9fbc849e6bd (patch) | |
| tree | 3ac3690be55a5b5561a781a0e8bebe1c4d1b6664 | |
| parent | 25239266d554a0442eb676044f03de9d43364c42 (diff) | |
RPM: fix double free in portmapper code
rpc_run_task is guaranteed to always call ->rpc_release.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Cc: Neil Brown <neilb@suse.de>
Cc: Jan "Yenya" Kasprzak <kas@fi.muni.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| -rw-r--r-- | net/sunrpc/pmap_clnt.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/net/sunrpc/pmap_clnt.c b/net/sunrpc/pmap_clnt.c index 3946ec3eb517..76e59e9b8fb8 100644 --- a/net/sunrpc/pmap_clnt.c +++ b/net/sunrpc/pmap_clnt.c @@ -62,7 +62,10 @@ static inline void pmap_map_free(struct portmap_args *map) static void pmap_map_release(void *data) { - pmap_map_free(data); + struct portmap_args *map = data; + + xprt_put(map->pm_xprt); + pmap_map_free(map); } static const struct rpc_call_ops pmap_getport_ops = { @@ -133,7 +136,7 @@ void rpc_getport(struct rpc_task *task) status = -EIO; child = rpc_run_task(pmap_clnt, RPC_TASK_ASYNC, &pmap_getport_ops, map); if (IS_ERR(child)) - goto bailout; + goto bailout_nofree; rpc_put_task(child); task->tk_xprt->stat.bind_count++; @@ -222,7 +225,6 @@ static void pmap_getport_done(struct rpc_task *child, void *data) child->tk_pid, status, map->pm_port); pmap_wake_portmap_waiters(xprt, status); - xprt_put(xprt); } /** |