Benjamin Coddington c68a027c05 nfs4: start callback_ident at idr 1
If clp->cl_cb_ident is zero, then nfs_cb_idr_remove_locked() skips removing
it when the nfs_client is freed.  A decoding or server bug can then find
and try to put that first nfs_client which would lead to a crash.

Signed-off-by: Benjamin Coddington <bcodding@redhat.com>
Fixes: d6870312659d ("nfs4client: convert to idr_alloc()")
Cc: stable@vger.kernel.org
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
2015-11-23 21:59:42 -05:00
..
2015-06-30 19:44:57 -07:00
2015-06-23 18:02:01 -04:00
2015-06-25 17:00:42 -07:00
2015-11-23 21:59:42 -05:00
2015-11-20 16:17:32 -08:00
2015-04-11 22:29:40 -04:00
2015-11-13 20:34:33 -05:00
2015-11-13 21:53:18 -08:00
2015-11-10 12:07:22 -08:00
2015-11-16 23:54:45 -08:00
2015-11-11 02:18:27 -05:00
2015-11-16 23:54:45 -08:00
2015-08-12 15:28:45 -05:00
2015-11-13 20:34:33 -05:00