Patch "nfs4: start callback_ident at idr 1" has been added to the 3.10-stable tree

This is a note to let you know that I've just added the patch titled

nfs4: start callback_ident at idr 1

to the 3.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
nfs4-start-callback_ident-at-idr-1.patch
and it can be found in the queue-3.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Benjamin Coddington <[email protected]>
Date: Fri, 20 Nov 2015 09:56:20 -0500
Subject: nfs4: start callback_ident at idr 1

From: Benjamin Coddington <[email protected]>

commit c68a027c05709330fe5b2f50c50d5fa02124b5d8 upstream.

If clp->cl_cb_ident is zero, then nfs_cb_idr_remove_locked() skips removing it when the nfs_client is freed. A decoding or server bug can then find and try to put that first nfs_client which would lead to a crash.

---
 fs/nfs/nfs4client.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -32,7 +32,7 @@ static int nfs_get_cb_ident_idr(struct n
 		return ret;
 	idr_preload(GFP_KERNEL);
 	spin_lock(&nn->nfs_client_lock);
-	ret = idr_alloc(&nn->cb_ident_idr, clp, 0, 0, GFP_NOWAIT);
+	ret = idr_alloc(&nn->cb_ident_idr, clp, 1, 0, GFP_NOWAIT);
 	if (ret >= 0)
 		clp->cl_cb_ident = ret;
 	spin_unlock(&nn->nfs_client_lock);

Patches currently in stable-queue which might be from [email protected] are

queue-3.10/nfs4-start-callback_ident-at-idr-1.patch