leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

sunrpc: svc_sock_names should hold ref to socket being closed.

Browse Source 
Currently svc_sock_names calls svc_close_xprt on a svc_sock to
which it does not own a reference.
As soon as svc_close_xprt sets XPT_CLOSE, the socket could be
freed by a separate thread (though this is a very unlikely race).

It is safer to hold a reference while calling svc_close_xprt.

Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
This commit is contained in:
NeilBrown 2010-11-15 11:27:01 +11:00 committed by J. Bruce Fields
parent 7c96aef759
commit 3942302ea9
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
net/sunrpc/svcsock.c
View File

@ -324,19 +324,21 @@ int svc_sock_names(struct svc_serv *serv, char *buf, const size_t buflen,
len = onelen;
break;
}
if (toclose && strcmp(toclose, buf + len) == 0)
if (toclose && strcmp(toclose, buf + len) == 0) {
closesk = svsk;
else
svc_xprt_get(&closesk->sk_xprt);
} else
len += onelen;
}
spin_unlock_bh(&serv->sv_lock);
if (closesk)
if (closesk) {
/* Should unregister with portmap, but you cannot
* unregister just one protocol...
*/
svc_close_xprt(&closesk->sk_xprt);
else if (toclose)
svc_xprt_put(&closesk->sk_xprt);
} else if (toclose)
return -ENOENT;
return len;
}