Commit e1e8399e authored by Vasily Averin's avatar Vasily Averin Committed by Chuck Lever

nfsd: memory corruption in nfsd4_lock()

New struct nfsd4_blocked_lock allocated in find_or_allocate_block()
does not initialized nbl_list and nbl_lru.
If conflock allocation fails rollback can call list_del_init()
access uninitialized fields and corrupt memory.

v2: just initialize nbl_list and nbl_lru right after nbl allocation.

Fixes: 76d348fa ("nfsd: have nfsd4_lock use blocking locks for v4.1+ lock")
Signed-off-by: default avatarVasily Averin <>
Reviewed-by: default avatarJeff Layton <>
Signed-off-by: default avatarChuck Lever <>
parent 8f3d9f35
......@@ -267,6 +267,8 @@ find_or_allocate_block(struct nfs4_lockowner *lo, struct knfsd_fh *fh,
if (!nbl) {
nbl= kmalloc(sizeof(*nbl), GFP_KERNEL);
if (nbl) {
fh_copy_shallow(&nbl->nbl_fh, fh);
nfsd4_init_cb(&nbl->nbl_cb, lo->lo_owner.so_client,
Markdown is supported
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment