Nishant Puri has uploaded this change for review.

View Change

SAL: restore NLM state owner refcount pairing

commit-id: dc03cb3 removed inc/dec_state_owner_ref on state_t create/destroy.
After NLM4_SHARE, the RPC drops its temporary owner ref while share
state_t and share lists remain, freeing the owner and leaving a
dangling state->state_owner (UAF on FREE_ALL/SM_NOTIFY cleanup).

Restore inc_state_owner_ref() in state_nlm_share() and
dec_state_owner_ref() in remove_nlm_share() so the owner lives for
the lifetime of the state_t.

Change-Id: I8829de9b1140852f207088e20c358a60dad75403
Signed-off-by: Nishant Puri <npuri@redhat.com>
---
M src/SAL/state_share.c
1 file changed, 11 insertions(+), 0 deletions(-)

git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/41/1243841/1

To view, visit change 1243841. To unsubscribe, or for help writing mail filters, visit settings.