Jim Chen has uploaded this change for review.
nfs4_op_sequence: Fix slot->sequence use-after-free on illegal replay
In nfs4_op_sequence(), when handling an illegal uncached replay
(slot->sequence == arg_SEQUENCE4->sa_sequenceid &&
slot->cached_result == NULL), PTHREAD_MUTEX_unlock(&slot->slot_lock)
and dec_session_ref(session) were called before LogDebugAlt() accessed
slot->sequence. Since slot points into session->fc_slots, dropping the
last reference to session frees both session and slot before
LogDebugAlt() reads slot->sequence.
Log the error while still holding slot->slot_lock and the session
reference, then unlock and call dec_session_ref(session).
Change-Id: I11358de77f344c3843704d328a85c5c90f3a8dc5
Signed-off-by: Jim Chen <czcbangkai@google.com>
---
M src/Protocols/NFS/nfs4_op_sequence.c
1 file changed, 3 insertions(+), 3 deletions(-)
git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/33/1255633/1
To view, visit change 1255633. To unsubscribe, or for help writing mail filters, visit settings.