Commit 2e4b7239 authored by J. Bruce Fields's avatar J. Bruce Fields

nfsd4: fix use-after-free of 4.1 client on connection loss

Once we drop the lock here there's nothing keeping the client around:
the only lock still held is the xpt_lock on this socket, but this socket
no longer has any connection with the client so there's no way for other
code to know we're still using the client.

The solution is simple: all nfsd4_probe_callback does is set a few
variables and queue some work, so there's no reason we can't just keep
it under the lock.
Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
parent b0a9d3ab
...@@ -761,8 +761,8 @@ static void nfsd4_conn_lost(struct svc_xpt_user *u) ...@@ -761,8 +761,8 @@ static void nfsd4_conn_lost(struct svc_xpt_user *u)
list_del(&c->cn_persession); list_del(&c->cn_persession);
free_conn(c); free_conn(c);
} }
spin_unlock(&clp->cl_lock);
nfsd4_probe_callback(clp); nfsd4_probe_callback(clp);
spin_unlock(&clp->cl_lock);
} }
static struct nfsd4_conn *alloc_conn(struct svc_rqst *rqstp, u32 flags) static struct nfsd4_conn *alloc_conn(struct svc_rqst *rqstp, u32 flags)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment