From patchwork Tue Jul 12 17:27:55 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ben Greear X-Patchwork-Id: 968962 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by demeter2.kernel.org (8.14.4/8.14.4) with ESMTP id p6CHS4ep028377 for ; Tue, 12 Jul 2011 17:28:04 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752970Ab1GLR2D (ORCPT ); Tue, 12 Jul 2011 13:28:03 -0400 Received: from mail.candelatech.com ([208.74.158.172]:56160 "EHLO ns3.lanforge.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751846Ab1GLR2C (ORCPT ); Tue, 12 Jul 2011 13:28:02 -0400 Received: from fs3.candelatech.com (firewall.candelatech.com [70.89.124.249]) by ns3.lanforge.com (8.14.2/8.14.2) with ESMTP id p6CHRwiV007773 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 12 Jul 2011 10:27:58 -0700 From: greearb@candelatech.com To: linux-nfs@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Ben Greear Subject: [PATCH] SUNRPC: Fix use of static variable in rpcb_getport_async Date: Tue, 12 Jul 2011 10:27:55 -0700 Message-Id: <1310491675-1699-1-git-send-email-greearb@candelatech.com> X-Mailer: git-send-email 1.7.3.4 Sender: linux-nfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-nfs@vger.kernel.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.6 (demeter2.kernel.org [140.211.167.43]); Tue, 12 Jul 2011 17:28:04 +0000 (UTC) From: Ben Greear Because struct rpcbind_args *map was declared static, if two threads entered this method at the same time, the values assigned to map could be sent two two differen tasks. This could cause all sorts of problems, include use-after-free and double-free of memory. Fix this by removing the static declaration so that the map pointer is on the stack. Signed-off-by: Ben Greear --- :100644 100644 353234c... 1695c73... M net/sunrpc/rpcb_clnt.c net/sunrpc/rpcb_clnt.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c index 353234c..1695c73 100644 --- a/net/sunrpc/rpcb_clnt.c +++ b/net/sunrpc/rpcb_clnt.c @@ -600,7 +600,7 @@ void rpcb_getport_async(struct rpc_task *task) u32 bind_version; struct rpc_xprt *xprt; struct rpc_clnt *rpcb_clnt; - static struct rpcbind_args *map; + struct rpcbind_args *map; struct rpc_task *child; struct sockaddr_storage addr; struct sockaddr *sap = (struct sockaddr *)&addr;