Jim Chen has uploaded this change for review.
nfs4_op_delegreturn: verify state_type is STATE_TYPE_DELEG
RFC 5661 Section 18.8.3 and RFC 7530 Section 16.6.4 require the server to
verify that the stateid passed to DELEGRETURN represents a delegation and
return NFS4ERR_BAD_STATEID if a non-delegation stateid (such as an open,
lock, or layout stateid) is supplied.
Currently, nfs4_op_delegreturn() calls nfs4_Check_Stateid() with
STATEID_SPECIAL_FOR_LOCK and immediately proceeds without verifying
state_found->state_type == STATE_TYPE_DELEG. If a client supplies a valid
open or lock stateid, DELEGRETURN corrupts delegation heuristics counters
in deleg_heuristics_recall(), issues an unintended FSAL lease unlock, and
deletes the active open or lock state via state_del_locked().
Verify that state_found->state_type == STATE_TYPE_DELEG before proceeding
and fail with NFS4ERR_BAD_STATEID while releasing the state reference.
Change-Id: I0d8583b5a5566ea76e6c9f78071281c0eadb6aa9
Signed-off-by: Jim Chen <czcbangkai@google.com>
---
M src/Protocols/NFS/nfs4_op_delegreturn.c
1 file changed, 5 insertions(+), 0 deletions(-)
git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/75/1257475/1
To view, visit change 1257475. To unsubscribe, or for help writing mail filters, visit settings.