shaharhoch@google.com has uploaded this change for review. ( https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1254180?usp=email ) Change subject: nfs4_op_sequence: Fix session use-after-free on ca_maxrequestsize error ...................................................................... nfs4_op_sequence: Fix session use-after-free on ca_maxrequestsize error In nfs4_op_sequence(), when request_size exceeds session->fore_channel_attrs.ca_maxrequestsize, dec_session_ref(session) is called before LogDebugAlt() reads session->fore_channel_attrs.ca_maxrequestsize. If that drops the last reference to the session, session is freed before LogDebugAlt() accesses it. Move dec_session_ref(session) after LogDebugAlt(). Change-Id: Ib6437f63e07ad858abf4494e103b5d31925d2e2f Signed-off-by: Shahar Hochma <shaharhoch@google.com> --- M src/Protocols/NFS/nfs4_op_sequence.c 1 file changed, 1 insertion(+), 1 deletion(-) git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/80/1254180/1 -- To view, visit https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1254180?usp=email To unsubscribe, or for help writing mail filters, visit https://review.gerrithub.io/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: ffilz/nfs-ganesha Gerrit-Branch: next Gerrit-Change-Id: Ib6437f63e07ad858abf4494e103b5d31925d2e2f Gerrit-Change-Number: 1254180 Gerrit-PatchSet: 1 Gerrit-Owner: shaharhoch@google.com