summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJ. Bruce Fields <bfields@fieldses.org>2006-12-04 20:22:32 -0500
committerTrond Myklebust <Trond.Myklebust@netapp.com>2006-12-06 10:46:43 -0500
commit87d918d667e51962938392759aef6ca368d6e96d (patch)
treeb501911296997106c226b53c486a4e61d629d2a6
parent8fc7500bb8ea3b5c909869d00628635e964ae882 (diff)
downloadlinux-3.10-87d918d667e51962938392759aef6ca368d6e96d.tar.gz
linux-3.10-87d918d667e51962938392759aef6ca368d6e96d.tar.bz2
linux-3.10-87d918d667e51962938392759aef6ca368d6e96d.zip
rpc: gss: fix a kmap_atomic race in krb5 code
This code is never called from interrupt context; it's always run by either a user thread or rpciod. So KM_SKB_SUNRPC_DATA is inappropriate here. Thanks to Aimé Le Rouzic for capturing an oops which showed the kernel taking an interrupt while we were in this piece of code, resulting in a nested kmap_atomic(.,KM_SKB_SUNRPC_DATA) call from xdr_partial_copy_from_skb(). Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
-rw-r--r--net/sunrpc/auth_gss/gss_krb5_wrap.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/net/sunrpc/auth_gss/gss_krb5_wrap.c b/net/sunrpc/auth_gss/gss_krb5_wrap.c
index 0f512e8e0d1..ad243872f54 100644
--- a/net/sunrpc/auth_gss/gss_krb5_wrap.c
+++ b/net/sunrpc/auth_gss/gss_krb5_wrap.c
@@ -57,9 +57,9 @@ gss_krb5_remove_padding(struct xdr_buf *buf, int blocksize)
>>PAGE_CACHE_SHIFT;
int offset = (buf->page_base + len - 1)
& (PAGE_CACHE_SIZE - 1);
- ptr = kmap_atomic(buf->pages[last], KM_SKB_SUNRPC_DATA);
+ ptr = kmap_atomic(buf->pages[last], KM_USER0);
pad = *(ptr + offset);
- kunmap_atomic(ptr, KM_SKB_SUNRPC_DATA);
+ kunmap_atomic(ptr, KM_USER0);
goto out;
} else
len -= buf->page_len;