diff options
| author | Chuck Lever <chuck.lever@oracle.com> | 2026-03-24 18:18:12 +0300 |
|---|---|---|
| committer | Chuck Lever <chuck.lever@oracle.com> | 2026-06-01 18:08:18 +0300 |
| commit | 625981c8f3da0cc2d236d7b46c39dd75554b8276 (patch) | |
| tree | 7ae7e47f8ae4fdbf8ceb5b4135bb8ff14a9d5882 /include | |
| parent | e7f558158edda53b89b456cc5795807459914f2e (diff) | |
| download | linux-625981c8f3da0cc2d236d7b46c39dd75554b8276.tar.xz | |
NFSD: Fix delegation reference leak in nfsd4_revoke_states
When revoking delegation state, nfsd4_revoke_states() takes an extra
reference on the stid before calling unhash_delegation_locked(). If
unhash_delegation_locked() returns false (the delegation was already
unhashed by a concurrent path), dp is set to NULL and
revoke_delegation() is skipped, but the extra reference is never
released. Each occurrence permanently pins the stid in memory. The
leaked reference also prevents nfs4_put_stid() from decrementing
cl_admin_revoked, leaving the counter permanently inflated.
Drop the extra reference in the failure path.
Fixes: 8dd91e8d31fe ("nfsd: fix race between laundromat and free_stateid")
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Diffstat (limited to 'include')
0 files changed, 0 insertions, 0 deletions