-
Trond Myklebust authored
If rpc_queue_upcall() adds a new upcall to the rpci->pipe list just after rpc_pipe_release calls rpc_purge_list(), but before it calls gss_pipe_release (as rpci->ops->release_pipe(inode)), then the latter will free a message without deleting it from the rpci->pipe list. We will be left with a freed object on the rpc->pipe list. Most frequent symptoms are kernel crashes in rpc.gssd system calls on the pipe in question. Reported-by:
J. Bruce Fields <bfields@redhat.com> Signed-off-by:
Trond Myklebust <Trond.Myklebust@netapp.com> Cc: stable@kernel.org
5a67657a