mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
synced 2025-01-11 08:18:47 +00:00
SUNRPC: fix use-after-free in rpc_free_client_work()
Parts of rpc_free_client() were recently moved to a separate rpc_free_clent_work(). This introduced a use-after-free as rpc_clnt_remove_pipedir() calls rpc_net_ns(), and that uses clnt->cl_xprt which has already been freed. So move the call to xprt_put() after the call to rpc_clnt_remove_pipedir(). Reported-by: syzbot+22b5ef302c7c40d94ea8@syzkaller.appspotmail.com Fixes: 7c4310ff5642 ("SUNRPC: defer slow parts of rpc_free_client() to a workqueue.") Signed-off-by: NeilBrown <neilb@suse.de> Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
This commit is contained in:
parent
2ef96a5bb1
commit
31e9a7f353
@ -890,6 +890,7 @@ static void rpc_free_client_work(struct work_struct *work)
|
||||
*/
|
||||
rpc_clnt_debugfs_unregister(clnt);
|
||||
rpc_clnt_remove_pipedir(clnt);
|
||||
xprt_put(rcu_dereference_raw(clnt->cl_xprt));
|
||||
|
||||
kfree(clnt);
|
||||
rpciod_down();
|
||||
@ -907,7 +908,6 @@ rpc_free_client(struct rpc_clnt *clnt)
|
||||
rpc_unregister_client(clnt);
|
||||
rpc_free_iostats(clnt->cl_metrics);
|
||||
clnt->cl_metrics = NULL;
|
||||
xprt_put(rcu_dereference_raw(clnt->cl_xprt));
|
||||
xprt_iter_destroy(&clnt->cl_xpi);
|
||||
put_cred(clnt->cl_cred);
|
||||
rpc_free_clid(clnt);
|
||||
|
Loading…
x
Reference in New Issue
Block a user