NFS: avoid NULL dereference in nfs_destroy_server
authorNeilBrown <neilb@suse.de>
Thu, 13 Dec 2012 04:14:36 +0000 (15:14 +1100)
committerBen Hutchings <ben@decadent.org.uk>
Thu, 3 Jan 2013 03:33:38 +0000 (03:33 +0000)
commit6f744386e26b664c948361d1ee539f258e4c2f8b
tree833d3d269ebb3fcfe86829927644a65c2292b425
parent61252278ee286b891e23dc0009aed1a9da1f0b0e
NFS: avoid NULL dereference in nfs_destroy_server

commit f259613a1e4b44a0cf85a5dafd931be96ee7c9e5 upstream.

In rare circumstances, nfs_clone_server() of a v2 or v3 server can get
an error between setting server->destory (to nfs_destroy_server), and
calling nfs_start_lockd (which will set server->nlm_host).

If this happens, nfs_clone_server will call nfs_free_server which
will call nfs_destroy_server and thence nlmclnt_done(NULL).  This
causes the NULL to be dereferenced.

So add a guard to only call nlmclnt_done() if ->nlm_host is not NULL.

The other guards there are irrelevant as nlm_host can only be non-NULL
if one of these flags are set - so remove those tests.  (Thanks to Trond
for this suggestion).

This is suitable for any stable kernel since 2.6.25.

Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
fs/nfs/client.c