From: Andi Kleen <andi@firstfloor.org>
To: greearb@candelatech.com, Trond.Myklebust@netapp.com,
ak@linux.intel.com, linux-kernel@vger.kernel.org,
stable@kernel.org, tim.bird@am.sony.com
Subject: [PATCH] [26/50] SUNRPC: Fix use of static variable in rpcb_getport_async
Date: Thu, 28 Jul 2011 16:44:30 -0700 (PDT) [thread overview]
Message-ID: <20110728234430.BFAF72403FF@tassilo.jf.intel.com> (raw)
In-Reply-To: <20110728444.299940435@firstfloor.org>
2.6.35-longterm review patch. If anyone has any objections, please let me know.
------------------
From: Ben Greear <greearb@candelatech.com>
[ upstream commit ec0dd267bf7d08cb30e321e45a75fd40edd7e528 ]
Because struct rpcbind_args *map was declared static, if two
threads entered this method at the same time, the values
assigned to map could be sent two two differen tasks.
This could cause all sorts of problems, include use-after-free
and double-free of memory.
Fix this by removing the static declaration so that the map
pointer is on the stack.
Signed-off-by: Ben Greear <greearb@candelatech.com>
Cc: stable@kernel.org
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Andi Kleen <ak@linux.intel.com>
Index: linux-2.6.35.y/net/sunrpc/rpcb_clnt.c
===================================================================
--- linux-2.6.35.y.orig/net/sunrpc/rpcb_clnt.c
+++ linux-2.6.35.y/net/sunrpc/rpcb_clnt.c
@@ -580,7 +580,7 @@ void rpcb_getport_async(struct rpc_task
u32 bind_version;
struct rpc_xprt *xprt;
struct rpc_clnt *rpcb_clnt;
- static struct rpcbind_args *map;
+ struct rpcbind_args *map;
struct rpc_task *child;
struct sockaddr_storage addr;
struct sockaddr *sap = (struct sockaddr *)&addr;
next prev parent reply other threads:[~2011-07-28 23:50 UTC|newest]
Thread overview: 57+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-07-28 23:44 [PATCH] [0/50] 2.6.35.14 longterm review Andi Kleen
2011-07-28 23:44 ` [PATCH] [1/50] x86: Make Dell Latitude E6420 use reboot=pci Andi Kleen
2011-07-28 23:44 ` [PATCH] [2/50] mm/futex: fix futex writes on archs with SW tracking of Andi Kleen
2011-07-28 23:44 ` [PATCH] [3/50] mm/backing-dev.c: reset bdi min_ratio in bdi_unregister() Andi Kleen
2011-07-28 23:44 ` [PATCH] [4/50] xtensa: prevent arbitrary read in ptrace Andi Kleen
2011-07-28 23:44 ` [PATCH] [5/50] ipc/sem.c: fix race with concurrent semtimedop() timeouts Andi Kleen
2011-07-28 23:44 ` [PATCH] [6/50] jme: Fix unmap error (Causing system freeze) Andi Kleen
2011-07-28 23:44 ` [PATCH] [7/50] fix crash in scsi_dispatch_cmd() Andi Kleen
2011-07-28 23:44 ` [PATCH] [8/50] mmc: Add PCI fixup quirks for Ricoh 1180:e823 reader Andi Kleen
2011-07-28 23:44 ` [PATCH] [9/50] mmc: Added quirks for Ricoh 1180:e823 lower base clock Andi Kleen
2011-07-29 0:27 ` matsumur
2011-07-29 0:37 ` Andi Kleen
2011-07-29 0:46 ` matsumur
2011-07-29 0:47 ` Chris Ball
2011-07-29 2:10 ` matsumur
2011-07-29 2:49 ` Chris Ball
2011-07-28 23:44 ` [PATCH] [10/50] Drop -Werror in perf Andi Kleen
2011-07-28 23:44 ` [PATCH] [11/50] kexec, x86: Fix incorrect jump back address if not Andi Kleen
2011-07-28 23:44 ` [PATCH] [12/50] USB: serial: add IDs for WinChipHead USB->RS232 adapter Andi Kleen
2011-07-28 23:44 ` [PATCH] [13/50] davinci: DM365 EVM: fix video input mux bits Andi Kleen
2011-07-28 23:44 ` [PATCH] [14/50] powerpc/pseries/hvconsole: Fix dropped console output Andi Kleen
2011-07-28 23:44 ` [PATCH] [15/50] hvc_console: Improve tty/console put_chars handling Andi Kleen
2011-07-28 23:44 ` [PATCH] [16/50] powerpc/kdump: Fix timeout in crash_kexec_wait_realmode Andi Kleen
2011-07-28 23:44 ` [PATCH] [17/50] si4713-i2c: avoid potential buffer overflow on si4713 Andi Kleen
2011-07-28 23:44 ` [PATCH] [18/50] hwmon: (max1111) Fix race condition causing NULL pointer Andi Kleen
2011-07-28 23:44 ` [PATCH] [19/50] hwmon: (asus_atk0110) Fix memory leak Andi Kleen
2011-07-28 23:44 ` [PATCH] [20/50] USB: OHCI: fix another regression for NVIDIA controllers Andi Kleen
2011-07-28 23:44 ` [PATCH] [21/50] firewire: cdev: prevent race between first get_info ioctl Andi Kleen
2011-07-28 23:44 ` [PATCH] [22/50] firewire: cdev: return -ENOTTY for unimplemented ioctls, not Andi Kleen
2011-07-28 23:44 ` [PATCH] [23/50] svcrpc: fix list-corrupting race on nfsd shutdown Andi Kleen
2011-07-28 23:44 ` [PATCH] [24/50] x86: Look for IA32_ENERGY_PERF_BIAS support Andi Kleen
2011-07-28 23:44 ` [PATCH] [25/50] x86, intel, power: Initialize MSR_IA32_ENERGY_PERF_BIAS Andi Kleen
2011-07-28 23:44 ` Andi Kleen [this message]
2011-07-28 23:44 ` [PATCH] [27/50] ARM: pxa/cm-x300: fix V3020 RTC functionality Andi Kleen
2011-07-28 23:44 ` [PATCH] [28/50] firewire: ohci: do not bind to Pinnacle cards, avert panic Andi Kleen
2011-07-28 23:44 ` [PATCH] [29/50] mm/nommu.c: fix remap_pfn_range() Andi Kleen
2011-07-28 23:44 ` [PATCH] [30/50] EHCI: only power off port if over-current is active Andi Kleen
2011-07-28 23:44 ` [PATCH] [31/50] mac80211: Restart STA timers only on associated state Andi Kleen
2011-07-28 23:44 ` [PATCH] [32/50] usb: musb: restore INDEX register in resume path Andi Kleen
2011-07-28 23:44 ` [PATCH] [33/50] SUNRPC: Fix a race between work-queue and rpc_killall_tasks Andi Kleen
2011-07-28 23:44 ` [PATCH] [34/50] bttv: fix s_tuner for radio Andi Kleen
2011-07-28 23:44 ` [PATCH] [35/50] pvrusb2: fix g/s_tuner support Andi Kleen
2011-07-28 23:44 ` [PATCH] [36/50] v4l2-ioctl.c: prefill tuner type for g_frequency and Andi Kleen
2011-07-28 23:44 ` [PATCH] [37/50] mac80211: fix TKIP replay vulnerability Andi Kleen
2011-07-28 23:44 ` [PATCH] [38/50] ASoC: ak4642: fixup snd_soc_update_bits mask for PW_MGMT2 Andi Kleen
2011-07-28 23:44 ` [PATCH] [39/50] tracing: Fix bug when reading system filters on module Andi Kleen
2011-07-28 23:44 ` [PATCH] [40/50] tracing: Have "enable" file use refcounts like the "filter" Andi Kleen
2011-07-28 23:44 ` [PATCH] [41/50] ARM: pxa: fix PGSR register address calculation Andi Kleen
2011-07-28 23:44 ` [PATCH] [42/50] iommu/amd: Don't use MSI address range for DMA addresses Andi Kleen
2011-07-28 23:44 ` [PATCH] [43/50] staging: r8192e_pci: Handle duplicate PCI ID 0x10ec:0x8192 Andi Kleen
2011-07-28 23:44 ` [PATCH] [44/50] staging: comedi: fix infoleak to userspace Andi Kleen
2011-07-28 23:44 ` [PATCH] [45/50] Staging: hv: netvsc: Fix a bug in accounting transmit slots Andi Kleen
2011-07-28 23:44 ` [PATCH] [46/50] ARM: 6989/1: perf: do not start the PMU when no events are Andi Kleen
2011-07-28 23:44 ` [PATCH] [47/50] ASoC: Ensure we delay long enough for WM8994 FLL to lock Andi Kleen
2011-07-28 23:44 ` [PATCH] [48/50] SERIAL: SC26xx: Fix link error Andi Kleen
2011-07-28 23:44 ` [PATCH] [49/50] x86, mtrr: lock stop machine during MTRR rendezvous sequence Andi Kleen
2011-07-28 23:44 ` [PATCH] [50/50] ipv6: add special mode forwarding=2 to send RS while Andi Kleen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20110728234430.BFAF72403FF@tassilo.jf.intel.com \
--to=andi@firstfloor.org \
--cc=Trond.Myklebust@netapp.com \
--cc=ak@linux.intel.com \
--cc=greearb@candelatech.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@kernel.org \
--cc=tim.bird@am.sony.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome