Commit e6cf91b7 authored by Xingyuan Mo's avatar Xingyuan Mo Committed by Chuck Lever
Browse files

NFSD: fix use-after-free in nfsd4_ssc_setup_dul() 



If signal_pending() returns true, schedule_timeout() will not be executed,
causing the waiting task to remain in the wait queue.
Fixed by adding a call to finish_wait(), which ensures that the waiting
task will always be removed from the wait queue.

Fixes: f4e44b39 ("NFSD: delay unmount source's export after inter-server copy completed.")
Signed-off-by: default avatarXingyuan Mo <hdthky0@gmail.com>
Reviewed-by: default avatarJeff Layton <jlayton@kernel.org>
Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
parent 5304930d

fs/nfsd/nfs4proc.c

+1 −0
Original line number Diff line number Diff line
@@ -1318,6 +1318,7 @@ static __be32 nfsd4_ssc_setup_dul(struct nfsd_net *nn, char *ipaddr, 
			/* allow 20secs for mount/unmount for now - revisit */

			if (signal_pending(current) ||

					(schedule_timeout(20*HZ) == 0)) {

				finish_wait(&nn->nfsd_ssc_waitq, &wait);

				kfree(work);

				return nfserr_eagain;

			}