• Kinglong Mee's avatar
    NFSD: Fix crash encoding lock reply on 32-bit · f98bac5a
    Kinglong Mee authored
    Commit 8c7424cf "nfsd4: don't try to encode conflicting owner if low
    on space" forgot to free conf->data in nfsd4_encode_lockt and before
    sign conf->data to NULL in nfsd4_encode_lock_denied, causing a leak.
    
    Worse, kfree() can be called on an uninitialized pointer in the case of
    a succesful lock (or one that fails for a reason other than a conflict).
    
    (Note that lock->lk_denied.ld_owner.data appears it should be zero here,
    until you notice that it's one arm of a union the other arm of which is
    written to in the succesful case by the
    
    	memcpy(&lock->lk_resp_stateid, &lock_stp->st_stid.sc_stateid,
    	                                sizeof(stateid_t));
    
    in nfsd4_lock().  In the 32-bit case this overwrites ld_owner.data.)
    Signed-off-by: default avatarKinglong Mee <kinglongmee@gmail.com>
    Fixes: 8c7424cf ""nfsd4: don't try to encode conflicting owner if low on space"
    Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
    f98bac5a
nfs4xdr.c 102 KB