Al Viro 68a8025a3b rpc_pipefs: fix double-dput() ...

commit 4a3877c4ce upstream.

if we ever hit rpc_gssd_dummy_depopulate() dentry passed to
it has refcount equal to 1.  __rpc_rmpipe() drops it and
dput() done after that hits an already freed dentry.

Cc: stable@kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2018-04-24 09:43:10 +02:00

36 KiB

Raw Blame History

View Raw