summaryrefslogtreecommitdiff
path: root/include/linux/sunrpc/bc_xprt.h
diff options
context:
space:
mode:
authorTrond Myklebust <Trond.Myklebust@netapp.com>2010-03-19 22:36:22 +0300
committerTrond Myklebust <Trond.Myklebust@netapp.com>2010-03-22 12:32:44 +0300
commitc9acb42ef1904d15d0fb315061cefbe638f67f3a (patch)
tree7c94dff168dfc90a279990cb2860cce626ae76a3 /include/linux/sunrpc/bc_xprt.h
parentcdead7cf12896c0e50a8be2e52de52c364603095 (diff)
downloadlinux-c9acb42ef1904d15d0fb315061cefbe638f67f3a.tar.xz
SUNRPC: Fix a use after free bug with the NFSv4.1 backchannel
The ->release_request() callback was designed to allow the transport layer to do housekeeping after the RPC call is done. It cannot be used to free the request itself, and doing so leads to a use-after-free bug in xprt_release(). Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Diffstat (limited to 'include/linux/sunrpc/bc_xprt.h')
-rw-r--r--include/linux/sunrpc/bc_xprt.h5
1 files changed, 4 insertions, 1 deletions
diff --git a/include/linux/sunrpc/bc_xprt.h b/include/linux/sunrpc/bc_xprt.h
index d7152b451e21..7c91260c44a9 100644
--- a/include/linux/sunrpc/bc_xprt.h
+++ b/include/linux/sunrpc/bc_xprt.h
@@ -36,7 +36,6 @@ struct rpc_rqst *xprt_alloc_bc_request(struct rpc_xprt *xprt);
void xprt_free_bc_request(struct rpc_rqst *req);
int xprt_setup_backchannel(struct rpc_xprt *, unsigned int min_reqs);
void xprt_destroy_backchannel(struct rpc_xprt *, int max_reqs);
-void bc_release_request(struct rpc_task *);
int bc_send(struct rpc_rqst *req);
/*
@@ -59,6 +58,10 @@ static inline int svc_is_backchannel(const struct svc_rqst *rqstp)
{
return 0;
}
+
+static inline void xprt_free_bc_request(struct rpc_rqst *req)
+{
+}
#endif /* CONFIG_NFS_V4_1 */
#endif /* _LINUX_SUNRPC_BC_XPRT_H */