Skip to content

Commit

Permalink
SUNRPC: Fix use of static variable in rpcb_getport_async
Browse files Browse the repository at this point in the history
Because struct rpcbind_args *map was declared static, if two
threads entered this method at the same time, the values
assigned to map could be sent two two differen tasks.
This could cause all sorts of problems, include use-after-free
and double-free of memory.

Fix this by removing the static declaration so that the map
pointer is on the stack.

Signed-off-by: Ben Greear <greearb@candelatech.com>
Cc: stable@kernel.org
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
  • Loading branch information
Ben Greear authored and Trond Myklebust committed Jul 12, 2011
1 parent e5012d1 commit ec0dd26
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion net/sunrpc/rpcb_clnt.c
Original file line number Diff line number Diff line change
Expand Up @@ -597,7 +597,7 @@ void rpcb_getport_async(struct rpc_task *task)
u32 bind_version;
struct rpc_xprt *xprt;
struct rpc_clnt *rpcb_clnt;
static struct rpcbind_args *map;
struct rpcbind_args *map;
struct rpc_task *child;
struct sockaddr_storage addr;
struct sockaddr *sap = (struct sockaddr *)&addr;
Expand Down

0 comments on commit ec0dd26

Please sign in to comment.