Commit 576acc25 authored by Scott Mayhew's avatar Scott Mayhew Committed by Trond Myklebust
Browse files

nfs4: take a reference on the nfs_client when running FREE_STATEID 



During umount, the session slot tables are freed.  If there are
outstanding FREE_STATEID tasks, a use-after-free and slab corruption can
occur when rpc_exit_task calls rpc_call_done -> nfs41_sequence_done ->
nfs4_sequence_process/nfs41_sequence_free_slot.

Prevent that from happening by taking a reference on the nfs_client in
nfs41_free_stateid and putting it in nfs41_free_stateid_release.

Signed-off-by: default avatarScott Mayhew <smayhew@redhat.com>
Signed-off-by: default avatarTrond Myklebust <trond.myklebust@hammerspace.com>
parent edfa0b16

fs/nfs/nfs4proc.c

+8 −0
Original line number Diff line number Diff line
@@ -10115,6 +10115,10 @@ static void nfs41_free_stateid_done(struct rpc_task *task, void *calldata) 


static void nfs41_free_stateid_release(void *calldata)

{

	struct nfs_free_stateid_data *data = calldata;

	struct nfs_client *clp = data->server->nfs_client;



	nfs_put_client(clp);

	kfree(calldata);

}
@@ -10151,6 +10155,10 @@ static int nfs41_free_stateid(struct nfs_server *server, 
	};

	struct nfs_free_stateid_data *data;

	struct rpc_task *task;

	struct nfs_client *clp = server->nfs_client;



	if (!refcount_inc_not_zero(&clp->cl_count))

		return -EIO;



	nfs4_state_protect(server->nfs_client, NFS_SP4_MACH_CRED_STATEID,

		&task_setup.rpc_client, &msg);