d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

During code inspection, I spotted that there was a code path where

Browse Source 
CLNT_CONTROL() would be called on "client" after it was
released via CLNT_RELEASE(). It was unlikely that this
code path gets executed and I have not heard of any problem
report caused by this bug. This patch fixes the code so that
this cannot happen.

MFC after:	2 months
This commit is contained in:
Rick Macklem 2013-11-03 23:17:30 +00:00
parent 1947c8a6d1
commit cc085ba84d
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=257598
1 changed files with 11 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
sys/fs/nfs/nfs_commonkrpc.c
View File

@ -336,24 +336,25 @@ newnfs_connect(struct nfsmount *nmp, struct nfssockreq *nrp,
mtx_lock(&nrp->nr_mtx);
if (nrp->nr_client != NULL) {
mtx_unlock(&nrp->nr_mtx);
/*
* Someone else already connected.
*/
CLNT_RELEASE(client);
} else {
nrp->nr_client = client;
/*
* Protocols that do not require connections may be optionally
* left unconnected for servers that reply from a port other
* than NFS_PORT.
*/
if (nmp == NULL || (nmp->nm_flag & NFSMNT_NOCONN) == 0) {
mtx_unlock(&nrp->nr_mtx);
CLNT_CONTROL(client, CLSET_CONNECT, &one);
} else
mtx_unlock(&nrp->nr_mtx);
}
/*
* Protocols that do not require connections may be optionally left
* unconnected for servers that reply from a port other than NFS_PORT.
*/
if (nmp == NULL || (nmp->nm_flag & NFSMNT_NOCONN) == 0) {
mtx_unlock(&nrp->nr_mtx);
CLNT_CONTROL(client, CLSET_CONNECT, &one);
} else {
mtx_unlock(&nrp->nr_mtx);
}
/* Restore current thread's credentials. */
td->td_ucred = origcred;