[PATCH 2/2] lockd: fix reference leak on lockowner allocation failure in nlmclnt_proc

[Ran Hongyun]

If nlmclnt_find_lockowner() fails, nlmclnt_release_call() is invoked
before call->a_callback_data is assigned, so it passes NULL to
nlmclnt_ops->nlmclnt_release_call() and the references taken by
nlmclnt_alloc_call() are leaked.

Fix it by moving the a_callback_data assignment before the lockowner
check, so nlmclnt_release_call() can free the references  properly.

Fixes: b1ece737f44f ("lockd: Introduce nlmclnt_operations")
Signed-off-by: Ran Hongyun <ranhongyun1@xxxxxxxxxx>
---
 fs/lockd/clntproc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/lockd/clntproc.c b/fs/lockd/clntproc.c
index dc0519ac0172..6b69a52788b7 100644
--- a/fs/lockd/clntproc.c
+++ b/fs/lockd/clntproc.c
@@ -171,6 +171,7 @@ int nlmclnt_proc(struct nlm_host *host, int cmd, struct file_lock *fl, void *dat
 
 	if (nlmclnt_ops && nlmclnt_ops->nlmclnt_alloc_call)
 		nlmclnt_ops->nlmclnt_alloc_call(data);
+	call->a_callback_data = data;
 
 	fl->fl_u.nfs_fl.state = 0;
 	fl->fl_u.nfs_fl.owner = nlmclnt_find_lockowner(host, fl->c.flc_owner);
@@ -184,7 +185,6 @@ int nlmclnt_proc(struct nlm_host *host, int cmd, struct file_lock *fl, void *dat
 
 	/* Set up the argument struct */
 	nlmclnt_setlockargs(call, fl);
-	call->a_callback_data = data;
 
 	if (IS_SETLK(cmd) || IS_SETLKW(cmd)) {
 		if (fl->c.flc_type != F_UNLCK) {
-- 
2.52.0