Jim Chen has uploaded this change for review. ( https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1257475?usp=email ) Change subject: nfs4_op_delegreturn: verify state_type is STATE_TYPE_DELEG ...................................................................... nfs4_op_delegreturn: verify state_type is STATE_TYPE_DELEG RFC 5661 Section 18.8.3 and RFC 7530 Section 16.6.4 require the server to verify that the stateid passed to DELEGRETURN represents a delegation and return NFS4ERR_BAD_STATEID if a non-delegation stateid (such as an open, lock, or layout stateid) is supplied. Currently, nfs4_op_delegreturn() calls nfs4_Check_Stateid() with STATEID_SPECIAL_FOR_LOCK and immediately proceeds without verifying state_found->state_type == STATE_TYPE_DELEG. If a client supplies a valid open or lock stateid, DELEGRETURN corrupts delegation heuristics counters in deleg_heuristics_recall(), issues an unintended FSAL lease unlock, and deletes the active open or lock state via state_del_locked(). Verify that state_found->state_type == STATE_TYPE_DELEG before proceeding and fail with NFS4ERR_BAD_STATEID while releasing the state reference. Change-Id: I0d8583b5a5566ea76e6c9f78071281c0eadb6aa9 Signed-off-by: Jim Chen <czcbangkai@google.com> --- M src/Protocols/NFS/nfs4_op_delegreturn.c 1 file changed, 5 insertions(+), 0 deletions(-) git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/75/1257475/1 -- To view, visit https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1257475?usp=email To unsubscribe, or for help writing mail filters, visit https://review.gerrithub.io/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: ffilz/nfs-ganesha Gerrit-Branch: next Gerrit-Change-Id: I0d8583b5a5566ea76e6c9f78071281c0eadb6aa9 Gerrit-Change-Number: 1257475 Gerrit-PatchSet: 1 Gerrit-Owner: Jim Chen <czcbangkai@google.com>