Re: [PATCH] nfsd: don't access freed memory when cannot grant a write delegation

[Chuck Lever]

On Mon, 02 Nov 2026 06:21:35 +0900, Haruka Kuze wrote:
> nfs4_open_delegation() hashes the delegation before the call to
> nfsd4_add_rdaccess_to_wrdeleg() and nfs4_delegation_stat(), both of which
> can sleep, and it calls destroy_delegation() from the error path after
> dropping the caller's reference.
> 
> Moreover, a DELEGRETURN from same client can unhash the delegation and
> drop the hash reference in this window, so nfs4_put_stid() frees it and
> destroy_delegation() then reads freed memory.
> 
> [...]

Applied to nfsd-testing, thanks!

[1/1] nfsd: don't access freed memory when cannot grant a write delegation
      commit: 2d3259f652bb0f1d137ccabecac6763da05064ec

--
Chuck Lever