]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
pNFS: Fix use-after-free in pnfs_update_layout()
authorWentao Liang <vulab@iscas.ac.cn>
Mon, 18 May 2026 13:10:36 +0000 (13:10 +0000)
committerAnna Schumaker <anna.schumaker@hammerspace.com>
Mon, 8 Jun 2026 14:21:55 +0000 (10:21 -0400)
commit13e198a90ca4050f4bee8a3f23680389a6563ccc
tree4e5c87fc830678bf352d7bb89e08aa68f5c0d84a
parent35168eb947f230aaa35fd8416a30563ef89f5421
pNFS: Fix use-after-free in pnfs_update_layout()

When hitting the NFS_LAYOUT_RETURN branch in pnfs_update_layout(),
the code calls pnfs_prepare_to_retry_layoutget(lo). If it succeeds,
pnfs_put_layout_hdr(lo) is called before trace_pnfs_update_layout(),
which still references 'lo'. This results in a use-after-free when the
tracepoint accesses lo's fields.

Fix this by moving the tracepoint call before pnfs_put_layout_hdr(lo).

Fixes: 2c8d5fc37fe2 ("pNFS: Stricter ordering of layoutget and layoutreturn")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
fs/nfs/pnfs.c