[PATCH 6.6.y] nfsd: fix NULL dereference in nfsd4_free_layout_stateid()

[Joseph Qi]

Commit d12af460df27 ("nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on
racing delegation revoke") replaced BUG_ON(!ls->ls_file) with a bail-out
that calls nfs4_put_stid() on the partially initialized layout stateid.

nfs4_alloc_stid() leaves sc_count at 1 and nothing takes another
reference before that bail-out, so the put runs sc_free, which is
nfsd4_free_layout_stateid().  That function uses ls->ls_file
unconditionally, both for vfs_setlease() and for nfsd_file_put(), and
nfsd_file_put() does not accept NULL either.  The new error path thus
turns the race it was meant to handle gracefully into a NULL pointer
dereference.  The nfsd4_layout_setlease() failure path that already
called nfs4_put_stid() was safe only because the BUG_ON guaranteed
ls_file was non-NULL.

Upstream does not have this problem because its destructor goes through
nfsd4_close_layout(), which tests the pointer before using it.  That
helper came in with the admin-revoke series, which is not in 6.6, so
just add the NULL test here.

Fixes: d12af460df27 ("nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke")
Signed-off-by: Joseph Qi <joseph.qi@xxxxxxxxxxxxxxxxx>
---
 fs/nfsd/nfs4layouts.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/fs/nfsd/nfs4layouts.c b/fs/nfsd/nfs4layouts.c
index bea7513a0de90..7c3f0948a610c 100644
--- a/fs/nfsd/nfs4layouts.c
+++ b/fs/nfsd/nfs4layouts.c
@@ -168,9 +168,13 @@ nfsd4_free_layout_stateid(struct nfs4_stid *stid)
 	list_del_init(&ls->ls_perfile);
 	spin_unlock(&fp->fi_lock);
 
-	if (!nfsd4_layout_ops[ls->ls_layout_type]->disable_recalls)
-		vfs_setlease(ls->ls_file->nf_file, F_UNLCK, NULL, (void **)&ls);
-	nfsd_file_put(ls->ls_file);
+	/* ls_file is NULL if nfsd4_alloc_layout_stateid() bailed out early */
+	if (ls->ls_file) {
+		if (!nfsd4_layout_ops[ls->ls_layout_type]->disable_recalls)
+			vfs_setlease(ls->ls_file->nf_file, F_UNLCK, NULL,
+				     (void **)&ls);
+		nfsd_file_put(ls->ls_file);
+	}
 
 	if (ls->ls_recalled)
 		atomic_dec(&ls->ls_stid.sc_file->fi_lo_recalls);
-- 
2.39.3