nfs4: take a reference on the nfs_client when running FREE_STATEID

Browse source

[ Upstream commit 576acc2591 ]

During umount, the session slot tables are freed.  If there are
outstanding FREE_STATEID tasks, a use-after-free and slab corruption can
occur when rpc_exit_task calls rpc_call_done -> nfs41_sequence_done ->
nfs4_sequence_process/nfs41_sequence_free_slot.

Prevent that from happening by taking a reference on the nfs_client in
nfs41_free_stateid and putting it in nfs41_free_stateid_release.

Signed-off-by: Scott Mayhew <smayhew@redhat.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Stable-dep-of: cf616096a0 ("NFS: Pin the 'struct nfs_server' during a FREE_STATEID call")
Signed-off-by: Sasha Levin <sashal@kernel.org>

...

This commit is contained in:

Scott Mayhew 2021-11-03 06:24:40 -04:00 • committed by Greg Kroah-Hartman

parent be7ae07fb7

commit 87bffcc31b

1 changed files with 8 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

8

fs/nfs/nfs4proc.c

View file