Jim Chen has uploaded this change for review.
nfs4_op_copy: fix async copy_offload_state UAF/seqid race and state_t ref leak
In copy_submit_job(), an asynchronous COPY job is submitted to
copy_fridge before nfs4_op_copy() calls fill_copy_response(res, data,
true, cos, 0). If copy_worker finishes or is cancelled before the RPC
thread reaches fill_copy_response(), destroy_copy_offload_state(cos)
drops the sole state_refcount and frees cos while fill_copy_response()
still locks and updates cos->cos_state. Additionally, in
check_copy_stateid(), when need_write is true and a non-write
delegation stateid is passed, NFS4ERR_BAD_STATEID is returned without
releasing the reference acquired by nfs4_Check_Stateid().
Initialize the async response via fill_copy_response() prior to
fridgethr_submit() and call dec_state_t_ref(state) before returning
NFS4ERR_BAD_STATEID in check_copy_stateid().
Change-Id: I06cc3a96cc2bb38c6a293138e0becd734f468214
Signed-off-by: Jim Chen <czcbangkai@google.com>
---
M src/Protocols/NFS/nfs4_op_copy.c
1 file changed, 5 insertions(+), 5 deletions(-)
git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/14/1256314/1
To view, visit change 1256314. To unsubscribe, or for help writing mail filters, visit settings.