This is a note to let you know that I've just added the patch titled
NFSv4.1: Fix a kfree() of uninitialised pointers in decode_cb_sequence_args
to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
nfsv4.1-fix-a-kfree-of-uninitialised-pointers-in-decode_cb_sequence_args.patch
and it can be found in the queue-3.18 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From d8ba1f971497c19cf80da1ea5391a46a5f9fbd41 Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.mykleb...@primarydata.com>
Date: Wed, 11 Feb 2015 17:27:55 -0500
Subject: NFSv4.1: Fix a kfree() of uninitialised pointers in
decode_cb_sequence_args
From: Trond Myklebust <trond.mykleb...@primarydata.com>
commit d8ba1f971497c19cf80da1ea5391a46a5f9fbd41 upstream.
If the call to decode_rc_list() fails due to a memory allocation error,
then we need to truncate the array size to ensure that we only call
kfree() on those pointer that were allocated.
Reported-by: David Ramos <dara...@stanford.edu>
Fixes: 4aece6a19cf7f ("nfs41: cb_sequence xdr implementation")
Signed-off-by: Trond Myklebust <trond.mykleb...@primarydata.com>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>
---
fs/nfs/callback_xdr.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/fs/nfs/callback_xdr.c
+++ b/fs/nfs/callback_xdr.c
@@ -464,8 +464,10 @@ static __be32 decode_cb_sequence_args(st
for (i = 0; i < args->csa_nrclists; i++) {
status = decode_rc_list(xdr, &args->csa_rclists[i]);
- if (status)
+ if (status) {
+ args->csa_nrclists = i;
goto out_free;
+ }
}
}
status = 0;
Patches currently in stable-queue which might be from
trond.mykleb...@primarydata.com are
queue-3.18/sunrpc-null-utsname-dereference-on-nfs-umount-during-namespace-cleanup.patch
queue-3.18/nfs-don-t-call-blocking-operations-while-task_running.patch
queue-3.18/nfsv4.1-fix-a-kfree-of-uninitialised-pointers-in-decode_cb_sequence_args.patch
queue-3.18/nfsv4-ensure-we-reference-the-inode-for-return-on-close-in-delegreturn.patch
queue-3.18/nfs-struct-nfs_commit_info.lock-must-always-point-to-inode-i_lock.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
