tmakin/ack-tegra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

NFS: null dereference in dev_remove()

Browse Source 
In commit 5ffaf85541 "NFS: replace global bl_wq with per-net one" we
made "msg" a pointer instead of a struct stored in stack memory.  But we
forgot to change the memset() here so we're still clearing stack memory
instead clearing the struct like we intended.  It will lead to a kernel
crash.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
This commit is contained in:
Dan Carpenter
2012-03-13 20:18:48 +03:00
committed by Trond Myklebust
parent 9a3ba43233
commit e138ead73f
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fs/nfs/blocklayout/blocklayoutdm.c
+1 -1
View File
@@ -54,7 +54,7 @@ static void dev_remove(struct net *net, dev_t dev)
dprintk("Entering %s\n", __func__); dprintk("Entering %s\n", __func__);
bl_pipe_msg.bl_wq = &nn->bl_wq; bl_pipe_msg.bl_wq = &nn->bl_wq;
memset(&msg, 0, sizeof(*msg)); memset(msg, 0, sizeof(*msg));
msg->data = kzalloc(1 + sizeof(bl_umount_request), GFP_NOFS); msg->data = kzalloc(1 + sizeof(bl_umount_request), GFP_NOFS);
if (!msg->data) if (!msg->data)
goto out; goto out;