Trond Myklebust f7f040a6b0 SUNRPC: Fix race corrupting rpc upcall ...

commit 5a67657a2e upstream.

If rpc_queue_upcall() adds a new upcall to the rpci->pipe list just
after rpc_pipe_release calls rpc_purge_list(), but before it calls
gss_pipe_release (as rpci->ops->release_pipe(inode)), then the latter
will free a message without deleting it from the rpci->pipe list.

We will be left with a freed object on the rpc->pipe list.  Most
frequent symptoms are kernel crashes in rpc.gssd system calls on the
pipe in question.

Reported-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

2010-09-20 13:18:14 -07:00

..

auth_gss

SUNRPC: Fix race corrupting rpc upcall

2010-09-20 13:18:14 -07:00

xprtrdma

headers: remove sched.h from interrupt.h

2009-10-11 11:20:58 -07:00

addr.c

SUNRPC: Address buffer overrun in rpc_uaddr2sockaddr()

2009-11-14 08:17:04 +09:00

auth_generic.c

SUNRPC: Defer the auth_gss upcall when the RPC call is asynchronous

2009-09-15 20:49:33 -04:00

auth_null.c

headers: utsname.h redux

2009-09-23 18:13:10 -07:00

auth_unix.c

SUNRPC: Use GFP_NOFS when allocating credentials

2008-07-09 12:08:48 -04:00

auth.c

SUNRPC: Defer the auth_gss upcall when the RPC call is asynchronous

2009-09-15 20:49:33 -04:00

backchannel_rqst.c

nfs41: sunrpc: xprt_alloc_bc_request() should not use spin_lock_bh()

2009-06-20 14:55:39 -04:00

bc_svc.c

nfs41: Backchannel callback service helper routines

2009-06-17 14:11:28 -07:00

cache.c

sunrpc/cache: avoid variable over-loading in cache_defer_req

2009-09-18 17:01:12 -04:00

clnt.c

net: fix htmldocs sunrpc, clnt.c

2009-09-24 15:39:14 -07:00

Kconfig

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial

2009-04-03 15:24:35 -07:00

Makefile

SUNRPC: Provide functions for managing universal addresses

2009-08-09 15:09:34 -04:00

rpc_pipe.c

SUNRPC: Fix race corrupting rpc upcall

2010-09-20 13:18:14 -07:00

rpcb_clnt.c

SUNRPC: Eliminate PROC macro from rpcb_clnt

2009-08-09 15:09:44 -04:00

sched.c

nfsd41: sunrpc: move struct rpc_buffer def into sunrpc.h

2009-09-10 12:09:06 -04:00

socklib.c

…

stats.c

nfs41: Rename rq_received to rq_reply_bytes_recvd

2009-06-17 14:11:40 -07:00

sunrpc_syms.c

SUNRPC: Ensure that sunrpc gets initialised before nfs, lockd, etc...

2009-08-21 08:17:56 -04:00

sunrpc.h

nfsd41: sunrpc: Added rpc server-side backchannel handling

2009-09-11 15:04:16 -04:00

svc_xprt.c

Revert "sunrpc: move the close processing after do recvfrom method"

2010-04-26 07:41:35 -07:00

svc.c

Merge commit 'linux-pnfs/nfs41-for-2.6.31' into nfsv41-for-2.6.31

2009-06-17 17:59:58 -07:00

svcauth_unix.c

nfsd4: don't try to map gid's in generic rpc code

2010-04-26 07:41:35 -07:00

svcauth.c

SUNRPC: The sunrpc server code should not be used by out-of-tree modules

2009-01-07 17:18:42 -05:00

svcsock.c

nfsd: ensure sockets are closed on error

2010-04-26 07:41:35 -07:00

sysctl.c

sysctl: remove "struct file *" argument of ->proc_handler

2009-09-24 07:21:04 -07:00

timer.c

SUNRPC: Add documenting comments in net/sunrpc/timer.c

2009-08-09 15:09:47 -04:00

xdr.c

sunrpc: ntoh -> be*_to_cpu

2009-08-14 13:12:52 -04:00

xprt.c

nfsd41: sunrpc: Added rpc server-side backchannel handling

2009-09-11 15:04:16 -04:00

xprtsock.c

SUNRPC: Fix a re-entrancy bug in xs_tcp_read_calldir()

2010-08-02 10:20:45 -07:00