Code: static struct nfs4_state *nfs4_try_open_cached(struct nfs4_opendata *opendata)
{
 	struct nfs4_state *state = opendata->state;
 	struct nfs_inode *nfsi = NFS_I(state->inode);
 	struct nfs_delegation *delegation;
	int open_mode = opendata->o_arg.open_flags & (FMODE_READ|FMODE_WRITE|O_EXCL);
 	nfs4_stateid stateid;
 	int ret = -EAGAIN;
 
 	for (;;) {
		if (can_open_cached(state, open_mode)) {
 			spin_lock(&state->owner->so_lock);
			if (can_open_cached(state, open_mode)) {
				update_open_stateflags(state, open_mode);
 				spin_unlock(&state->owner->so_lock);
 				goto out_return_state;
 			}
			spin_unlock(&state->owner->so_lock);
		}
 		rcu_read_lock();
 		delegation = rcu_dereference(nfsi->delegation);
 		if (delegation == NULL ||
		    !can_open_delegated(delegation, open_mode)) {
 			rcu_read_unlock();
 			break;
 		}
		/* Save the delegation */
		memcpy(stateid.data, delegation->stateid.data, sizeof(stateid.data));
		rcu_read_unlock();
		ret = nfs_may_open(state->inode, state->owner->so_cred, open_mode);
		if (ret != 0)
			goto out;
 		ret = -EAGAIN;
 
 		/* Try to update the stateid using the delegation */
		if (update_open_stateid(state, NULL, &stateid, open_mode))
 			goto out_return_state;
 	}
 out:
	return ERR_PTR(ret);
out_return_state:
	atomic_inc(&state->count);
	return state;
}

Vulnerability Type: DoS 
CWE ID: 
Summary: The encode_share_access function in fs/nfs/nfs4xdr.c in the Linux kernel before 2.6.29 allows local users to cause a denial of service (BUG and system crash) by using the mknod system call with a pathname on an NFSv4 filesystem.
Commit Message: NFSv4: Convert the open and close ops to use fmode

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>