NFSD: fix use-after-free in nfsd4_ssc_setup_dul()
[ Upstream commite6cf91b7b4
] If signal_pending() returns true, schedule_timeout() will not be executed, causing the waiting task to remain in the wait queue. Fixed by adding a call to finish_wait(), which ensures that the waiting task will always be removed from the wait queue. Fixes:f4e44b3933
("NFSD: delay unmount source's export after inter-server copy completed.") Signed-off-by: Xingyuan Mo <hdthky0@gmail.com> Reviewed-by: Jeff Layton <jlayton@kernel.org> Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
24af570c99
commit
0a27dcd534
|
@ -1205,6 +1205,7 @@ static __be32 nfsd4_ssc_setup_dul(struct nfsd_net *nn, char *ipaddr,
|
|||
/* allow 20secs for mount/unmount for now - revisit */
|
||||
if (signal_pending(current) ||
|
||||
(schedule_timeout(20*HZ) == 0)) {
|
||||
finish_wait(&nn->nfsd_ssc_waitq, &wait);
|
||||
kfree(work);
|
||||
return nfserr_eagain;
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue