[PATCH] NFS: Fix layout header use-after-free in pnfs_update_layout()
From: Wentao Liang
Date: Thu Sep 17 2026 - 15:51:49 EST
When waiting for an in-progress layoutreturn to complete, the retry path
drops the reference on the layout header with pnfs_put_layout_hdr() and
only then passes the layout header to trace_pnfs_update_layout(). If
that was the last reference, for example because the layout was torn
down while the task slept in pnfs_prepare_to_retry_layoutget(), the
tracepoint dereferences freed memory.
Move the pnfs_put_layout_hdr() call after the tracepoint so the layout
header is still valid while it is being traced.
Fixes: 2c8d5fc37fe2 ("pNFS: Stricter ordering of layoutget and layoutreturn")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
fs/nfs/pnfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index 743467e9ba20..aee523134c0f 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -2229,11 +2229,11 @@ pnfs_update_layout(struct inode *ino,
dprintk("%s wait for layoutreturn\n", __func__);
lseg = ERR_PTR(pnfs_prepare_to_retry_layoutget(lo));
if (!IS_ERR(lseg)) {
- pnfs_put_layout_hdr(lo);
dprintk("%s retrying\n", __func__);
trace_pnfs_update_layout(ino, pos, count, iomode, lo,
lseg,
PNFS_UPDATE_LAYOUT_RETRY);
+ pnfs_put_layout_hdr(lo);
goto lookup_again;
}
trace_pnfs_update_layout(ino, pos, count, iomode, lo, lseg,
--
2.34.1