]> CyberLeo.Net >> Repos - FreeBSD/FreeBSD.git/commit
nfscl: Fix use after free for forced dismount
authorRick Macklem <rmacklem@FreeBSD.org>
Wed, 3 Nov 2021 19:15:40 +0000 (12:15 -0700)
committerRick Macklem <rmacklem@FreeBSD.org>
Wed, 17 Nov 2021 01:20:01 +0000 (17:20 -0800)
commit4a03ae8d17ddf3d3b57ca281000fd98e200b92cc
tree40e5ffd2c50eb4cc403e2de73b3e6a4f8b68b19c
parent6fc80c13284fd3c7e53a273a7ef001e66fe7f7be
nfscl: Fix use after free for forced dismount

When a forced dismount is done and delegations are being
issued by the server (disabled by default for FreeBSD
servers), the delegation structure is free'd before the
loop calling vflush().  This could result in a use after
free of the delegation structure.

This patch changes the code so that the delegation
structures are not free'd until after the vflush()
loop for forced dismounts.

Found during a recent IETF NFSv4 working group testing event.

(cherry picked from commit 441222585968517c595ef7f39e5c71a42d238acd)
sys/fs/nfs/nfs_var.h
sys/fs/nfsclient/nfs_clstate.c
sys/fs/nfsclient/nfs_clvfsops.c