imrcpan/erofs-linux
1
0 Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs.git synced 2026-10-28 12:53:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease()

Browse Source 
When nfs4_add_lease() races with a delegation return, it calls
nfs4_delete_lease() to clean up. Previously, it passed priv,
which can legitimately be NULL. Passing a NULL priv eventually
leads to a NULL pointer dereference in generic_setlease().

Fixes: e93a5e9306 ("NFSv4: Add support for application leases underpinned by a delegation")
Signed-off-by: Zhansong Gao <[email protected]>
Signed-off-by: Trond Myklebust <[email protected]>
This commit is contained in:
Zhansong Gao authored and Trond Myklebust committed 2026-08-17 09:02:08 -07:00
1 parent 4c7fc129db
commit 468e458ffd
1 file changed
+3 -1
Download Patch File Download Diff File Expand all files Collapse all files
fs/nfs/nfs4proc.c
+3 -1
View File
@@ -7817,6 +7817,7 @@ static int nfs4_add_lease(struct file *file, int arg, struct file_lease **lease,
{
struct inode *inode = file_inode(file);
fmode_t type = arg == F_RDLCK ? FMODE_READ : FMODE_WRITE;
fl_owner_t owner = (*lease)->c.flc_owner;
int ret;
/* No delegation, no lease */
@@ -7826,7 +7827,8 @@ static int nfs4_add_lease(struct file *file, int arg, struct file_lease **lease,
if (ret || nfs4_have_delegation(inode, type, 0))
return ret;
/* We raced with a delegation return */
nfs4_delete_lease(file, priv);
dprintk("%s: raced with a delegation return\n", __func__);
nfs4_delete_lease(file, &owner);
return -EAGAIN;
}