roybabayov@gmail.com has uploaded this change for review. ( https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1259048?usp=email ) Change subject: Don't cache a reply in a slot that SEQUENCE no longer holds ...................................................................... Don't cache a reply in a slot that SEQUENCE no longer holds - When SEQUENCE fails its reply size check, it drops the slot lock and the session reference but leaves the slot set for caching the reply. - The end of the request then writes the reply into that slot without the lock, so a concurrent DESTROY_SESSION can free the slot first and the write hits freed memory. - Clear the slot and the cache flag before dropping the lock, so a failed SEQUENCE caches nothing. Change-Id: Ib0b2337b32193d97eb11a363225ca68a5173a537 Signed-off-by: Roy Babayov <roybabayov@google.com> --- M src/Protocols/NFS/nfs4_op_sequence.c 1 file changed, 7 insertions(+), 0 deletions(-) git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/48/1259048/1 -- To view, visit https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1259048?usp=email To unsubscribe, or for help writing mail filters, visit https://review.gerrithub.io/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: ffilz/nfs-ganesha Gerrit-Branch: next Gerrit-Change-Id: Ib0b2337b32193d97eb11a363225ca68a5173a537 Gerrit-Change-Number: 1259048 Gerrit-PatchSet: 1 Gerrit-Owner: roybabayov@gmail.com