Commit 62835679 authored by Trond Myklebust's avatar Trond Myklebust

SUNRPC: Fix potential memory scribble in xprt_free_bc_request()

The call to xprt_free_allocation() will call list_del() on
req->rq_bc_pa_list, which is not attached to a list.
This patch moves the list_del() out of xprt_free_allocation()
and into those callers that need it.
Signed-off-by: default avatarTrond Myklebust <trond.myklebust@primarydata.com>
parent 06ea0bfe
...@@ -64,7 +64,6 @@ static void xprt_free_allocation(struct rpc_rqst *req) ...@@ -64,7 +64,6 @@ static void xprt_free_allocation(struct rpc_rqst *req)
free_page((unsigned long)xbufp->head[0].iov_base); free_page((unsigned long)xbufp->head[0].iov_base);
xbufp = &req->rq_snd_buf; xbufp = &req->rq_snd_buf;
free_page((unsigned long)xbufp->head[0].iov_base); free_page((unsigned long)xbufp->head[0].iov_base);
list_del(&req->rq_bc_pa_list);
kfree(req); kfree(req);
} }
...@@ -168,8 +167,10 @@ int xprt_setup_backchannel(struct rpc_xprt *xprt, unsigned int min_reqs) ...@@ -168,8 +167,10 @@ int xprt_setup_backchannel(struct rpc_xprt *xprt, unsigned int min_reqs)
/* /*
* Memory allocation failed, free the temporary list * Memory allocation failed, free the temporary list
*/ */
list_for_each_entry_safe(req, tmp, &tmp_list, rq_bc_pa_list) list_for_each_entry_safe(req, tmp, &tmp_list, rq_bc_pa_list) {
list_del(&req->rq_bc_pa_list);
xprt_free_allocation(req); xprt_free_allocation(req);
}
dprintk("RPC: setup backchannel transport failed\n"); dprintk("RPC: setup backchannel transport failed\n");
return -ENOMEM; return -ENOMEM;
...@@ -198,6 +199,7 @@ void xprt_destroy_backchannel(struct rpc_xprt *xprt, unsigned int max_reqs) ...@@ -198,6 +199,7 @@ void xprt_destroy_backchannel(struct rpc_xprt *xprt, unsigned int max_reqs)
xprt_dec_alloc_count(xprt, max_reqs); xprt_dec_alloc_count(xprt, max_reqs);
list_for_each_entry_safe(req, tmp, &xprt->bc_pa_list, rq_bc_pa_list) { list_for_each_entry_safe(req, tmp, &xprt->bc_pa_list, rq_bc_pa_list) {
dprintk("RPC: req=%p\n", req); dprintk("RPC: req=%p\n", req);
list_del(&req->rq_bc_pa_list);
xprt_free_allocation(req); xprt_free_allocation(req);
if (--max_reqs == 0) if (--max_reqs == 0)
break; break;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment