Re: [PATCH] nfsd: don't access freed memory when cannot grant a write delegation

[NeilBrown]

On Mon, 02 Nov 2026, Haruka Kuze wrote:
> From: Haruka Kuze <harukak@xxxxxxxxxxx>
> 
> nfs4_open_delegation() hashes the delegation before the call to
> nfsd4_add_rdaccess_to_wrdeleg() and nfs4_delegation_stat(), both of which
> can sleep, and it calls destroy_delegation() from the error path after
> dropping the caller's reference.
> 
> Moreover, a DELEGRETURN from same client can unhash the delegation and
> drop the hash reference in this window, so nfs4_put_stid() frees it and
> destroy_delegation() then reads freed memory.
> 
> Call destroy_delegation() before dropping the caller reference.
> 
> Fixes: c5967721e106 ("NFSD: handle GETATTR conflict with write delegation")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Haruka Kuze <harukak@xxxxxxxxxxx>
> ---
>  fs/nfsd/nfs4state.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
> index 1de6c6d757c3..b13d05fe8993 100644
> --- a/fs/nfsd/nfs4state.c
> +++ b/fs/nfsd/nfs4state.c
> @@ -7300,8 +7300,8 @@ nfs4_open_delegation(struct svc_rqst *rqstp, struct nfsd4_open *open,
>  		f = rcu_dereference_protected(dp->dl_stid.sc_file->fi_deleg_file, 1)->nf_file;
>  		if (!nfsd4_add_rdaccess_to_wrdeleg(rqstp, open, fh, stp) ||
>  				!nfs4_delegation_stat(dp, currentfh, &stat)) {
> -			nfs4_put_stid(&dp->dl_stid);
>  			destroy_delegation(dp);
> +			nfs4_put_stid(&dp->dl_stid);

So it seems strange to access the delegation after it has been
"destroyed", but I can see that this change does fix a real problem.

Maybe "destroy_delegation" isn't a good name for the function.
Maybe "deactivate_delegation" or something like that.

That is a separate problem those.  This patch is good.  The one other
use of destroy_delegation() is correctly followed by a nfs4_put_stid().

Reviewed-by: NeilBrown <neil@xxxxxxxxxx>

Thanks,
NeilBrown


>  			goto out_no_deleg;
>  		}
>  		open->op_delegate_type = deleg_ts ? OPEN_DELEGATE_WRITE_ATTRS_DELEG :
> -- 
> 2.55.0
> 
>