Jim Chen has uploaded this change for review.
nfs4_op_open: fix NULL deref in open4_ex and UAF in error cleanup
In open4_ex(), when open4_create_fh() fails on a newly created state
(*new_state == true), the code calls state_del_locked(*file_state), sets
*file_state = NULL, and sets *new_state = false. However, it omitted
unlocking STATELOCK and omitted 'goto out;'. Execution fell through to
'if (!(*new_state))', which evaluated to true and dereferenced the NULL
*file_state pointer.
Additionally, in nfs4_op_open() exit cleanup, dec_state_t_ref(file_state)
was invoked before state_del(file_state). For a newly created state with
refcount 1, this freed file_state before state_del(file_state) ran.
Unlock STATELOCK and jump to out on open4_create_fh() failure in
open4_ex(), and invoke state_del(file_state) before
dec_state_t_ref(file_state) in nfs4_op_open().
Change-Id: I0aac60a80288d4924d8fc5df7d83ee14ad014156
Signed-off-by: Jim Chen <czcbangkai@google.com>
---
M src/Protocols/NFS/nfs4_op_open.c
1 file changed, 6 insertions(+), 3 deletions(-)
git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/29/1257729/1
To view, visit change 1257729. To unsubscribe, or for help writing mail filters, visit settings.