提交 e138ead7 编写于 作者: D Dan Carpenter 提交者: Trond Myklebust

NFS: null dereference in dev_remove()

In commit 5ffaf855 "NFS: replace global bl_wq with per-net one" we
made "msg" a pointer instead of a struct stored in stack memory.  But we
forgot to change the memset() here so we're still clearing stack memory
instead clearing the struct like we intended.  It will lead to a kernel
crash.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NTrond Myklebust <Trond.Myklebust@netapp.com>
上级 9a3ba432
......@@ -54,7 +54,7 @@ static void dev_remove(struct net *net, dev_t dev)
dprintk("Entering %s\n", __func__);
bl_pipe_msg.bl_wq = &nn->bl_wq;
memset(&msg, 0, sizeof(*msg));
memset(msg, 0, sizeof(*msg));
msg->data = kzalloc(1 + sizeof(bl_umount_request), GFP_NOFS);
if (!msg->data)
goto out;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册