1:13 a.m.
liyinshu has uploaded this change for review. (
https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/548005 )
Change subject: Fix crash for used after free of res_compound4_extended when replay
request
......................................................................
Fix crash for used after free of res_compound4_extended when replay request
This caused by commit 5f06bd1c40b89c726ccb0f0284caace66d12a1d0, which first
release_nfs4_res_compound(data->res->res_compound4_extended), then assign
res_SEQUENCE4->sr_status with NFS4_OK. Because res_SEQUENCE4 is in
data->res->res_compound4_extended, so heap used after free happens.
Actually we did not need to assign res_SEQUENCE4->sr_status with NFS4_OK
for replay request, because it will comes from slot->cached_result.
Even before commit 5f06bd1c40b89c726ccb0f0284caace66d12a1d0,
the res_SEQUENCE4 also will be freed in complete_op by release_nfs4_res_compound,
so we did not need to assign the value of res_SEQUENCE4.
Change-Id: I9e3f4823e23718bf421c5237cc78a878b6f3014e
Signed-off-by: liyinshu <liyinshu(a)bytedance.com>
---
M src/Protocols/NFS/nfs4_op_sequence.c
1 file changed, 20 insertions(+), 1 deletion(-)
git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/05/548005/1
--
To view, visit https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/548005
To unsubscribe, or for help writing mail filters, visit
https://review.gerrithub.io/settings
Gerrit-Project: ffilz/nfs-ganesha
Gerrit-Branch: next
Gerrit-Change-Id: I9e3f4823e23718bf421c5237cc78a878b6f3014e
Gerrit-Change-Number: 548005
Gerrit-PatchSet: 1
Gerrit-Owner: liyinshu <liyinshu(a)bytedance.com>
Gerrit-MessageType: newchange