diff options
| author | Zhansong Gao <zhsgao@hotmail.com> | 2026-07-23 04:00:59 +0800 |
|---|---|---|
| committer | Trond Myklebust <trond.myklebust@hammerspace.com> | 2026-08-17 09:02:08 -0700 |
| commit | 468e458ffde907ba19acd2102ca1fbb8f6fbede2 (patch) | |
| tree | d7c5862afc5a63dbb358ef8f65f3bf6577a2be12 | |
| parent | 4c7fc129db061c7daab841c4f3c342d894832362 (diff) | |
| download | linux-468e458ffde907ba19acd2102ca1fbb8f6fbede2.tar.gz linux-468e458ffde907ba19acd2102ca1fbb8f6fbede2.zip | |
NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease()
When nfs4_add_lease() races with a delegation return, it calls
nfs4_delete_lease() to clean up. Previously, it passed priv,
which can legitimately be NULL. Passing a NULL priv eventually
leads to a NULL pointer dereference in generic_setlease().
Fixes: e93a5e9306a5 ("NFSv4: Add support for application leases underpinned by a delegation")
Signed-off-by: Zhansong Gao <zhsgao@hotmail.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
| -rw-r--r-- | fs/nfs/nfs4proc.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c index b79d121ea069..04b1987115d5 100644 --- a/fs/nfs/nfs4proc.c +++ b/fs/nfs/nfs4proc.c @@ -7817,6 +7817,7 @@ static int nfs4_add_lease(struct file *file, int arg, struct file_lease **lease, { struct inode *inode = file_inode(file); fmode_t type = arg == F_RDLCK ? FMODE_READ : FMODE_WRITE; + fl_owner_t owner = (*lease)->c.flc_owner; int ret; /* No delegation, no lease */ @@ -7826,7 +7827,8 @@ static int nfs4_add_lease(struct file *file, int arg, struct file_lease **lease, if (ret || nfs4_have_delegation(inode, type, 0)) return ret; /* We raced with a delegation return */ - nfs4_delete_lease(file, priv); + dprintk("%s: raced with a delegation return\n", __func__); + nfs4_delete_lease(file, &owner); return -EAGAIN; } |