Commit 0d3a34b4 authored by Trond Myklebust's avatar Trond Myklebust

SUNRPC: Fix a double-free in rpcbind

It is wrong to be freeing up the rpcbind arguments if the call to
rpcb_call_async() fails, since they should already have been freed up by
rpcb_map_release().
Signed-off-by: default avatarTrond Myklebust <Trond.Myklebust@netapp.com>
parent 2aac05a9
...@@ -365,18 +365,16 @@ void rpcb_getport_async(struct rpc_task *task) ...@@ -365,18 +365,16 @@ void rpcb_getport_async(struct rpc_task *task)
rpc_release_client(rpcb_clnt); rpc_release_client(rpcb_clnt);
if (IS_ERR(child)) { if (IS_ERR(child)) {
status = -EIO; status = -EIO;
/* rpcb_map_release() has freed the arguments */
dprintk("RPC: %5u %s: rpc_run_task failed\n", dprintk("RPC: %5u %s: rpc_run_task failed\n",
task->tk_pid, __func__); task->tk_pid, __func__);
goto bailout; goto bailout_nofree;
} }
rpc_put_task(child); rpc_put_task(child);
task->tk_xprt->stat.bind_count++; task->tk_xprt->stat.bind_count++;
return; return;
bailout:
kfree(map);
xprt_put(xprt);
bailout_nofree: bailout_nofree:
rpcb_wake_rpcbind_waiters(xprt, status); rpcb_wake_rpcbind_waiters(xprt, status);
bailout_nowake: bailout_nowake:
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment