Jim Chen has uploaded this change for review. ( https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1257729?usp=email ) Change subject: nfs4_op_open: fix NULL deref in open4_ex and UAF in error cleanup ...................................................................... nfs4_op_open: fix NULL deref in open4_ex and UAF in error cleanup In open4_ex(), when open4_create_fh() fails on a newly created state (*new_state == true), the code calls state_del_locked(*file_state), sets *file_state = NULL, and sets *new_state = false. However, it omitted unlocking STATELOCK and omitted 'goto out;'. Execution fell through to 'if (!(*new_state))', which evaluated to true and dereferenced the NULL *file_state pointer. Additionally, in nfs4_op_open() exit cleanup, dec_state_t_ref(file_state) was invoked before state_del(file_state). For a newly created state with refcount 1, this freed file_state before state_del(file_state) ran. Unlock STATELOCK and jump to out on open4_create_fh() failure in open4_ex(), and invoke state_del(file_state) before dec_state_t_ref(file_state) in nfs4_op_open(). Change-Id: I0aac60a80288d4924d8fc5df7d83ee14ad014156 Signed-off-by: Jim Chen <czcbangkai@google.com> --- M src/Protocols/NFS/nfs4_op_open.c 1 file changed, 6 insertions(+), 3 deletions(-) git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/29/1257729/1 -- To view, visit https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1257729?usp=email To unsubscribe, or for help writing mail filters, visit https://review.gerrithub.io/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: ffilz/nfs-ganesha Gerrit-Branch: next Gerrit-Change-Id: I0aac60a80288d4924d8fc5df7d83ee14ad014156 Gerrit-Change-Number: 1257729 Gerrit-PatchSet: 1 Gerrit-Owner: Jim Chen <czcbangkai@google.com>