NFSD: Fix a null reference case in find_or_create_lock_stateid()
authorKinglong Mee <kinglongmee@gmail.com>
Wed, 18 Jan 2017 11:04:42 +0000 (19:04 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 9 Feb 2017 07:02:45 +0000 (08:02 +0100)
commit2b4e56fde91be9719880e5cf5d30bbe5a037b675
tree071bfc816ce4872d3f6ffbe3fcb51127b83c1f58
parentf584bb6df7a25425d1045ebd3310b8ce00cec0e4
NFSD: Fix a null reference case in find_or_create_lock_stateid()

commit d19fb70dd68c4e960e2ac09b0b9c79dfdeefa726 upstream.

nfsd assigns the nfs4_free_lock_stateid to .sc_free in init_lock_stateid().

If nfsd doesn't go through init_lock_stateid() and put stateid at end,
there is a NULL reference to .sc_free when calling nfs4_put_stid(ns).

This patch let the nfs4_stid.sc_free assignment to nfs4_alloc_stid().

Fixes: 356a95ece7aa "nfsd: clean up races in lock stateid searching..."
Signed-off-by: Kinglong Mee <kinglongmee@gmail.com>
Reviewed-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/nfsd/nfs4layouts.c
fs/nfsd/nfs4state.c
fs/nfsd/state.h