Attachment 172425 Details for Bug 253754 – untested proposed patch

[patch] untested proposed patch

linux-2.6.9-svc-exit-thread-use-after-free.patch (text/plain), 1.67 KB, created by Jeff Layton on 2007-08-24 15:12:20 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jeff Layton

Created: 2007-08-24 15:12:20 UTC

Size: 1.67 KB

patch

obsolete

>diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c
>index f19fa77..fe07f99 100644
>--- a/fs/lockd/svc.c
>+++ b/fs/lockd/svc.c
>@@ -232,11 +232,14 @@ lockd(struct svc_rqst *rqstp)
> 	wake_up(&lockd_exit);
> 		
> 	/* Exit the RPC thread */
>-	svc_exit_thread(rqstp);
>+	__svc_exit_thread(rqstp);
> 
> 	/* release rpciod */
> 	rpciod_down();
> 
>+	if (serv)
>+		kfree(serv);
>+
> 	/* Release module */
> 	unlock_kernel();
> 	module_put_and_exit(0);
>diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h
>index 6266324..c10c995 100644
>--- a/include/linux/sunrpc/svc.h
>+++ b/include/linux/sunrpc/svc.h
>@@ -311,6 +311,7 @@ typedef void		(*svc_thread_fn)(struct svc_rqst *);
>  */
> struct svc_serv *  svc_create(struct svc_program *, unsigned int);
> int		   svc_create_thread(svc_thread_fn, struct svc_serv *);
>+void		   __svc_exit_thread(struct svc_rqst *);
> void		   svc_exit_thread(struct svc_rqst *);
> void		   svc_destroy(struct svc_serv *);
> int		   svc_process(struct svc_serv *, struct svc_rqst *);
>diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
>index 4447482..65c46ab 100644
>--- a/net/sunrpc/svc.c
>+++ b/net/sunrpc/svc.c
>@@ -191,10 +191,8 @@ out_thread:
>  * Destroy an RPC server thread
>  */
> void
>-svc_exit_thread(struct svc_rqst *rqstp)
>+__svc_exit_thread(struct svc_rqst *rqstp)
> {
>-	struct svc_serv	*serv = rqstp->rq_server;
>-
> 	svc_release_buffer(rqstp);
> 	if (rqstp->rq_resp)
> 		kfree(rqstp->rq_resp);
>@@ -203,6 +201,14 @@ svc_exit_thread(struct svc_rqst *rqstp)
> 	if (rqstp->rq_auth_data)
> 		kfree(rqstp->rq_auth_data);
> 	kfree(rqstp);
>+}
>+
>+void
>+svc_exit_thread(struct svc_rqst *rqstp)
>+{
>+	struct svc_serv	*serv = rqstp->rq_server;
>+
>+	__svc_exit_thread(rqstp);
> 
> 	/* Release the server */
> 	if (serv)

Actions: View | Diff

Attachments on bug 253754: 172425 | 191861 | 199971 | 326987