7ca9e472ce
[ Upstream commit c88c150a467fcb670a1608e2272beeee3e86df6e ]
When multiple FREE_STATEIDs are sent for the same delegation stateid,
it can lead to a possible either use-after-free or counter refcount
underflow errors.
In nfsd4_free_stateid() under the client lock we find a delegation
stateid, however the code drops the lock before calling nfs4_put_stid(),
that allows another FREE_STATE to find the stateid again. The first one
will proceed to then free the stateid which leads to either
use-after-free or decrementing already zeroed counter.
Fixes:
|
||
|---|---|---|
| .. | ||
| acl.h | ||
| auth.c | ||
| auth.h | ||
| blocklayout.c | ||
| blocklayoutxdr.c | ||
| blocklayoutxdr.h | ||
| cache.h | ||
| current_stateid.h | ||
| export.c | ||
| export.h | ||
| filecache.c | ||
| filecache.h | ||
| flexfilelayout.c | ||
| flexfilelayoutxdr.c | ||
| flexfilelayoutxdr.h | ||
| idmap.h | ||
| Kconfig | ||
| lockd.c | ||
| Makefile | ||
| netlink.c | ||
| netlink.h | ||
| netns.h | ||
| nfs2acl.c | ||
| nfs3acl.c | ||
| nfs3proc.c | ||
| nfs3xdr.c | ||
| nfs4acl.c | ||
| nfs4callback.c | ||
| nfs4idmap.c | ||
| nfs4layouts.c | ||
| nfs4proc.c | ||
| nfs4recover.c | ||
| nfs4state.c | ||
| nfs4xdr.c | ||
| nfscache.c | ||
| nfsctl.c | ||
| nfsd.h | ||
| nfsfh.c | ||
| nfsfh.h | ||
| nfsproc.c | ||
| nfssvc.c | ||
| nfsxdr.c | ||
| pnfs.h | ||
| state.h | ||
| stats.c | ||
| stats.h | ||
| trace.c | ||
| trace.h | ||
| vfs.c | ||
| vfs.h | ||
| xdr.h | ||
| xdr3.h | ||
| xdr4.h | ||
| xdr4cb.h | ||