Re: [PATCH 0/2] lockd: fix two bugs on nlmclnt_find_lockowner() failure path

[Jeff Layton]

On Wed, 2026-08-19 at 15:46 +0800, Ran Hongyun wrote:
> Both bugs are triggered when nlmclnt_find_lockowner() returns NULL
> due to allocation failure in nlmclnt_proc():
> 
> Patch 1 fixes a NULL pointer dereference: nlmclnt_locks_init_private()
> unconditionally sets fl->fl_ops before checking whether owner is NULL,
> so locks_release_private() later calls fl_release_private which
> dereferences the NULL owner. Fix by inlining the function so that
> fl_ops is only set after the owner is valid.
> 
> Patch 2 fixes a reference leak: call->a_callback_data has not been
> assigned when nlmclnt_release_call() is invoked on the error path,
> so nlmclnt_ops->nlmclnt_release_call(NULL) skips cleanup and the
> references taken by nlmclnt_alloc_call() are never freed. Fix by
> moving the assignment before the lockowner check.
> 
> Ran Hongyun (2):
>   lockd: fix NULL pointer dereference in nlmclnt_locks_release_private
>   lockd: fix reference leak on lockowner allocation failure in
>     nlmclnt_proc
> 
>  fs/lockd/clntproc.c | 19 +++++++------------
>  1 file changed, 7 insertions(+), 12 deletions(-)

To be clear, these are client-side patches. Anna/Trond, can you pick
these up?

Thanks,
-- 
Jeff Layton <jlayton@xxxxxxxxxx>