]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
NFS: take a delegation reference in nfs4_get_valid_delegation
authorChristoph Hellwig <hch@lst.de>
Wed, 7 Jan 2026 07:27:08 +0000 (08:27 +0100)
committerAnna Schumaker <anna.schumaker@oracle.com>
Tue, 20 Jan 2026 19:49:46 +0000 (14:49 -0500)
commit542b11c0728335a1e06f61dc71b48e9bbbe13169
tree273190dd637f706f10b2e42bc34e5a48b9e90953
parent23e6208755cae5afd350f6805c7ea70bfd2b336d
NFS: take a delegation reference in nfs4_get_valid_delegation

Currently most work on struct nfs_delegation happens directly under RCU
protection.  This is generally fine, despite that long RCU sections are
not good for performance.  But for operations later taking a reference
to the delegation to perform blocking work, refcount_inc is used, which
can be racy against dropping the last reference and thus lead to use
after frees in extremely rare cases.

Fix this by taking a reference in nfs4_get_valid_delegation using
refcount_inc_not_zero so that the callers have a stabilized reference
they can work with and can be moved outside the RCU critical section.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
fs/nfs/callback_proc.c
fs/nfs/delegation.c
fs/nfs/delegation.h
fs/nfs/nfs4proc.c