• Trond Myklebust's avatar
    SUNRPC: Fix race corrupting rpc upcall · 5a67657a
    Trond Myklebust authored
    If rpc_queue_upcall() adds a new upcall to the rpci->pipe list just
    after rpc_pipe_release calls rpc_purge_list(), but before it calls
    gss_pipe_release (as rpci->ops->release_pipe(inode)), then the latter
    will free a message without deleting it from the rpci->pipe list.
    
    We will be left with a freed object on the rpc->pipe list.  Most
    frequent symptoms are kernel crashes in rpc.gssd system calls on the
    pipe in question.
    Reported-by: default avatarJ. Bruce Fields <bfields@redhat.com>
    Signed-off-by: default avatarTrond Myklebust <Trond.Myklebust@netapp.com>
    Cc: stable@kernel.org
    5a67657a
rpc_pipe.c 24.8 KB