Jim Chen has uploaded this change for review. ( https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1256314?usp=email ) Change subject: nfs4_op_copy: fix async copy_offload_state UAF/seqid race and state_t ref leak ...................................................................... nfs4_op_copy: fix async copy_offload_state UAF/seqid race and state_t ref leak In copy_submit_job(), an asynchronous COPY job is submitted to copy_fridge before nfs4_op_copy() calls fill_copy_response(res, data, true, cos, 0). If copy_worker finishes or is cancelled before the RPC thread reaches fill_copy_response(), destroy_copy_offload_state(cos) drops the sole state_refcount and frees cos while fill_copy_response() still locks and updates cos->cos_state. Additionally, in check_copy_stateid(), when need_write is true and a non-write delegation stateid is passed, NFS4ERR_BAD_STATEID is returned without releasing the reference acquired by nfs4_Check_Stateid(). Initialize the async response via fill_copy_response() prior to fridgethr_submit() and call dec_state_t_ref(state) before returning NFS4ERR_BAD_STATEID in check_copy_stateid(). Change-Id: I06cc3a96cc2bb38c6a293138e0becd734f468214 Signed-off-by: Jim Chen <czcbangkai@google.com> --- M src/Protocols/NFS/nfs4_op_copy.c 1 file changed, 5 insertions(+), 5 deletions(-) git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/14/1256314/1 -- To view, visit https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1256314?usp=email To unsubscribe, or for help writing mail filters, visit https://review.gerrithub.io/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: ffilz/nfs-ganesha Gerrit-Branch: next Gerrit-Change-Id: I06cc3a96cc2bb38c6a293138e0becd734f468214 Gerrit-Change-Number: 1256314 Gerrit-PatchSet: 1 Gerrit-Owner: Jim Chen <czcbangkai@google.com>