github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 12:44:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

NFS: Pin the 'struct nfs_server' during a FREE_STATEID call

Browse Source 
Dan Aloni reports that he was able to hit a use-after-free bug if a
FREE_STATEID operation gets delayed for whatever reason. Fix this by
bumping the refcount of the 'struct nfs_server' object for the duration
of the FREE_STATEID so it doesn't get cleaned up from underneath us
while operations are still in flight.

Reported-by: Dan Aloni <dan.aloni@vastdata.com>
Fixes: 7c1d5fae4a ("NFSv4: Convert nfs41_free_stateid to use an asynchronous RPC call")
Tested-by: Dan Aloni <dan.aloni@vastdata.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
This commit is contained in:
Anna Schumaker 2026-06-30 14:31:00 -04:00
parent 1590cf0329
commit cf616096a0
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
fs/nfs/nfs4proc.c
View File

@ -10364,6 +10364,7 @@ static void nfs41_free_stateid_release(void *calldata)
struct nfs_free_stateid_data *data = calldata;
struct nfs_client *clp = data->server->nfs_client;
nfs_sb_deactive(data->server->super);
nfs_put_client(clp);
kfree(calldata);
}
@ -10405,6 +10406,10 @@ static int nfs41_free_stateid(struct nfs_server *server,
if (!refcount_inc_not_zero(&clp->cl_count))
return -EIO;
if (!nfs_sb_active(server->super)) {
nfs_put_client(clp);
return -EIO;
}
nfs4_state_protect(clp, NFS_SP4_MACH_CRED_STATEID,
&task_setup.rpc_client, &msg);