Rajesh Prasad has uploaded this change for review. ( https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1245847?usp=email ) Change subject: Fix NULL ev_p Crash During Blocked Lock Grant ...................................................................... Fix NULL ev_p Crash During Blocked Lock Grant Bug: Ganesha crashes with a NULL dereference in `svc_rqst_expire_insert` when granting a blocked NFSv4 lock to a client that disconnected before the grant was attempted. Event Sequence: Client A - Acquires lock on file F Client B - Requests same lock; placed in blocked-lock queue (`STATE_BLOCKING`) Client B - Disconnect — `svc_rqst_unreg()` clears `rec->ev_p = NULL Client A - Issues `LOCKU` — lock released Ganesha - Calls `grant_blocked_locks()` — Client B's entry is the first candidate Ganesha - `nfsv4_granted_callback()` → `nfs_rpc_cb_single()` → `nfs_rpc_call()` → `CLNT_CALL_BACK()` → `clnt_req_callback()` → `svc_rqst_expire_insert()` CRASH - `sr_rec = cx->cx_rec->ev_p` is `NULL` → `mutex_lock(sr_rec->)` → SIGSEGV Fix: Before building the `CB_COMPOUND` payload, verify the client still has a working back channel. NFSv4.0 — read the `cb_chan_down` flag NFSv4.1/4.2 — scan `cb_session_list` under `cid_mutex` for any session that has `session_bc_up` set Handle RPC failure case - Covers the narrow race where the transport is destroyed after the pre-check passes but before (or during) the RPC send. If RPC failed, remove entry, try next. Used `STATE_ESTALE` to cleans up correctly - `try_to_grant_lock()` handles the return value of the callback: ``` STATE_LOCK_BLOCKED → restore sle_blocked, leave in list (will retry) STATE_SUCCESS → return (lock granted, entry promoted) anything else → fall through to remove_from_locklist() ``` `STATE_ESTALE` is "anything else", so the entry is removed. `grant_blocked_locks()` uses `glist_for_each_safe`, so after the entry is removed the loop automatically advances to the next blocked waiter. Change-Id: I119d51ff60fb20022a1e38e3c1c510da8f45dcb2 Signed-off-by: Rajesh Prasad <raprasad(a)redhat.com&gt; --- M src/Protocols/NFS/nfs4_op_lock.c 1 file changed, 69 insertions(+), 7 deletions(-) git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/47/1245847/1 -- To view, visit https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1245847?usp=email To unsubscribe, or for help writing mail filters, visit https://review.gerrithub.io/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: ffilz/nfs-ganesha Gerrit-Branch: next Gerrit-Change-Id: I119d51ff60fb20022a1e38e3c1c510da8f45dcb2 Gerrit-Change-Number: 1245847 Gerrit-PatchSet: 1 Gerrit-Owner: Rajesh Prasad <raprasad(a)redhat.com&gt;