]> www.infradead.org Git - users/dwmw2/linux.git/commit
nfsd: fix use-after-free in nfsd_file_do_acquire tracepoint
authorJeff Layton <jlayton@kernel.org>
Sat, 5 Nov 2022 13:49:26 +0000 (09:49 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 10 Apr 2024 14:19:20 +0000 (16:19 +0200)
commit98d400fc2d0919a63b12e91320cfafc05988ff3b
treebabe0eca2608a8ca509ac9a49754c6ee5ecb0391
parent3ec2c9976c17d78f515f5988e6dd1cc16033edab
nfsd: fix use-after-free in nfsd_file_do_acquire tracepoint

[ Upstream commit bdd6b5624c62d0acd350d07564f1c82fe649235f ]

When we fail to insert into the hashtable with a non-retryable error,
we'll free the object and then goto out_status. If the tracepoint is
enabled, it'll end up accessing the freed object when it tries to
grab the fields out of it.

Set nf to NULL after freeing it to avoid the issue.

Fixes: 243a5263014a ("nfsd: rework hashtable handling in nfsd_do_file_acquire")
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
fs/nfsd/filecache.c