Commit 3d1a90ab authored by Dave Wysochanski's avatar Dave Wysochanski Committed by Trond Myklebust
Browse files

NFS4: Fix use-after-free in trace_event_raw_event_nfs4_set_lock 



It is only safe to call the tracepoint before rpc_put_task() because
'data' is freed inside nfs4_lock_release (rpc_release).

Fixes: 48c9579a ("Adding stateid information to tracepoints")
Signed-off-by: default avatarDave Wysochanski <dwysocha@redhat.com>
Signed-off-by: default avatarTrond Myklebust <trond.myklebust@hammerspace.com>
parent e71ba945

fs/nfs/nfs4proc.c

+1 −1
Original line number Diff line number Diff line
@@ -7111,9 +7111,9 @@ static int _nfs4_do_setlk(struct nfs4_state *state, int cmd, struct file_lock *f 
					data->arg.new_lock_owner, ret);

	} else

		data->cancelled = true;

	trace_nfs4_set_lock(fl, state, &data->res.stateid, cmd, ret);

	rpc_put_task(task);

	dprintk("%s: done, ret = %d!\n", __func__, ret);

	trace_nfs4_set_lock(fl, state, &data->res.stateid, cmd, ret);

	return ret;

}