Commit 91fd3c3e authored Jan 13, 2020 by Dan Carpenter Committed by J. Bruce Fields Feb 06, 2020

nfsd4: fix double free in nfsd4_do_async_copy()



This frees "copy->nf_src" before and again after the goto.

Fixes: ce0887ac ("NFSD add nfs4 inter ssc to nfsd4_copy")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Olga Kornievskaia <kolga@netapp.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>

parent 689827cd

fs/nfsd/nfs4proc.c

+0 −1

Original line number	Diff line number	Diff line
		@@ -1469,7 +1469,6 @@ static int nfsd4_do_async_copy(void *data)
		copy->nf_src->nf_file = nfs42_ssc_open(copy->ss_mnt, &copy->c_fh,
		&copy->stateid);
		if (IS_ERR(copy->nf_src->nf_file)) {
		kfree(copy->nf_src);
		copy->nfserr = nfserr_offload_denied;
		nfsd4_interssc_disconnect(copy->ss_mnt);
		goto do_callback;

Admin message