Nishant Puri has uploaded this change for review. ( https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1243841?usp=email ) Change subject: SAL: restore NLM state owner refcount pairing ...................................................................... SAL: restore NLM state owner refcount pairing commit-id: dc03cb3 removed inc/dec_state_owner_ref on state_t create/destroy. After NLM4_SHARE, the RPC drops its temporary owner ref while share state_t and share lists remain, freeing the owner and leaving a dangling state->state_owner (UAF on FREE_ALL/SM_NOTIFY cleanup). Restore inc_state_owner_ref() in state_nlm_share() and dec_state_owner_ref() in remove_nlm_share() so the owner lives for the lifetime of the state_t. Change-Id: I8829de9b1140852f207088e20c358a60dad75403 Signed-off-by: Nishant Puri <npuri(a)redhat.com&gt; --- M src/SAL/state_share.c 1 file changed, 11 insertions(+), 0 deletions(-) git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/41/1243841/1 -- To view, visit https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1243841?usp=email To unsubscribe, or for help writing mail filters, visit https://review.gerrithub.io/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: ffilz/nfs-ganesha Gerrit-Branch: next Gerrit-Change-Id: I8829de9b1140852f207088e20c358a60dad75403 Gerrit-Change-Number: 1243841 Gerrit-PatchSet: 1 Gerrit-Owner: Nishant Puri <npuri(a)redhat.com&gt;