roybabayov@gmail.com has uploaded this change for review.

View Change

Don't cache a reply in a slot that SEQUENCE no longer holds

- When SEQUENCE fails its reply size check, it drops the slot lock and
  the session reference but leaves the slot set for caching the reply.
- The end of the request then writes the reply into that slot without
  the lock, so a concurrent DESTROY_SESSION can free the slot first and
  the write hits freed memory.
- Clear the slot and the cache flag before dropping the lock, so a
  failed SEQUENCE caches nothing.

Change-Id: Ib0b2337b32193d97eb11a363225ca68a5173a537
Signed-off-by: Roy Babayov <roybabayov@google.com>
---
M src/Protocols/NFS/nfs4_op_sequence.c
1 file changed, 7 insertions(+), 0 deletions(-)

git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/48/1259048/1

To view, visit change 1259048. To unsubscribe, or for help writing mail filters, visit settings.