Re: [PATCH 0/2] lockd: fix two bugs on nlmclnt_find_lockowner() failure path

[Jeff Layton]

nit: usually when you send a new version of a patchset you should
declare it as "v2". So "PATCH v2 0/2", etc...

Using the b4 command makes this easy to track.

On Wed, 2026-08-19 at 15:46 +0800, Ran Hongyun wrote:
> Both bugs are triggered when nlmclnt_find_lockowner() returns NULL
> due to allocation failure in nlmclnt_proc():
> 
> Patch 1 fixes a NULL pointer dereference: nlmclnt_locks_init_private()
> unconditionally sets fl->fl_ops before checking whether owner is NULL,
> so locks_release_private() later calls fl_release_private which
> dereferences the NULL owner. Fix by inlining the function so that
> fl_ops is only set after the owner is valid.
> 
> Patch 2 fixes a reference leak: call->a_callback_data has not been
> assigned when nlmclnt_release_call() is invoked on the error path,
> so nlmclnt_ops->nlmclnt_release_call(NULL) skips cleanup and the
> references taken by nlmclnt_alloc_call() are never freed. Fix by
> moving the assignment before the lockowner check.
> 
> Ran Hongyun (2):
>   lockd: fix NULL pointer dereference in nlmclnt_locks_release_private
>   lockd: fix reference leak on lockowner allocation failure in
>     nlmclnt_proc
> 
>  fs/lockd/clntproc.c | 19 +++++++------------
>  1 file changed, 7 insertions(+), 12 deletions(-)

New version looks good. Note it looks like Shuangpeng Bai sent a less
complete patch for this problem back in July that I just noticed. Your
version seems more correct though.

Reviewed-by: Jeff Layton <jlayton@xxxxxxxxxx>