Jim Chen has uploaded this change for review. ( https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1255633?usp=email ) Change subject: nfs4_op_sequence: Fix slot->sequence use-after-free on illegal replay ...................................................................... nfs4_op_sequence: Fix slot->sequence use-after-free on illegal replay In nfs4_op_sequence(), when handling an illegal uncached replay (slot->sequence == arg_SEQUENCE4->sa_sequenceid && slot->cached_result == NULL), PTHREAD_MUTEX_unlock(&slot->slot_lock) and dec_session_ref(session) were called before LogDebugAlt() accessed slot->sequence. Since slot points into session->fc_slots, dropping the last reference to session frees both session and slot before LogDebugAlt() reads slot->sequence. Log the error while still holding slot->slot_lock and the session reference, then unlock and call dec_session_ref(session). Change-Id: I11358de77f344c3843704d328a85c5c90f3a8dc5 Signed-off-by: Jim Chen <czcbangkai@google.com> --- M src/Protocols/NFS/nfs4_op_sequence.c 1 file changed, 3 insertions(+), 3 deletions(-) git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/33/1255633/1 -- To view, visit https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1255633?usp=email To unsubscribe, or for help writing mail filters, visit https://review.gerrithub.io/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: ffilz/nfs-ganesha Gerrit-Branch: next Gerrit-Change-Id: I11358de77f344c3843704d328a85c5c90f3a8dc5 Gerrit-Change-Number: 1255633 Gerrit-PatchSet: 1 Gerrit-Owner: Jim Chen <czcbangkai@google.com>