Jim Chen has uploaded this change for review. ( https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1256315?usp=email ) Change subject: SAL: refcount shared callback state in nfs41_foreach_client_callback ...................................................................... SAL: refcount shared callback state in nfs41_foreach_client_callback nfs41_foreach_client_callback() passed the caller's heap-allocated state pointer directly to every per-client async worker (client_cb) and called gsh_free(cb_arg->state, MEM_COMP_STATE) inside each worker. With N >= 2 NFSv4.1 clients, this triggered N-1 use-after-frees and double-frees; with 0 NFSv4.1 clients (or when fridgethr_submit failed), state was leaked. Wrap state in a reference-counted struct client_callback_state so state is freed exactly once after all queued per-client callbacks and the table walk complete. Change-Id: I5500d46a19fea3e2179ef747e4c8e19d6a7d8a66 Signed-off-by: Jim Chen <czcbangkai@google.com> --- M src/SAL/nfs4_clientid.c 1 file changed, 28 insertions(+), 4 deletions(-) git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/15/1256315/1 -- To view, visit https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1256315?usp=email To unsubscribe, or for help writing mail filters, visit https://review.gerrithub.io/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: ffilz/nfs-ganesha Gerrit-Branch: next Gerrit-Change-Id: I5500d46a19fea3e2179ef747e4c8e19d6a7d8a66 Gerrit-Change-Number: 1256315 Gerrit-PatchSet: 1 Gerrit-Owner: Jim Chen <czcbangkai@google.com>