From: Dave Wysochanski <dwysocha@redhat.com>
Date: Fri, 11 Dec 2020 10:12:51 +0000 (-0500)
Subject: NFS4: Fix use-after-free in trace_event_raw_event_nfs4_set_lock
X-Git-Tag: rel_imx_5.10.35_2.0.0-somdevices.0~427^2~32
X-Git-Url: https://git.somdevices.com/?a=commitdiff_plain;h=1b42712e43e5d574a985661e336e48b0f6ba06b6;p=linux.git

NFS4: Fix use-after-free in trace_event_raw_event_nfs4_set_lock

commit 3d1a90ab0ed93362ec8ac85cf291243c87260c21 upstream.

It is only safe to call the tracepoint before rpc_put_task() because
'data' is freed inside nfs4_lock_release (rpc_release).

Fixes: 48c9579a1afe ("Adding stateid information to tracepoints")
Signed-off-by: Dave Wysochanski <dwysocha@redhat.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 6858b4bb556d..1218fe058f80 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -7106,9 +7106,9 @@ static int _nfs4_do_setlk(struct nfs4_state *state, int cmd, struct file_lock *f
 					data->arg.new_lock_owner, ret);
 	} else
 		data->cancelled = true;
+	trace_nfs4_set_lock(fl, state, &data->res.stateid, cmd, ret);
 	rpc_put_task(task);
 	dprintk("%s: done, ret = %d!\n", __func__, ret);
-	trace_nfs4_set_lock(fl, state, &data->res.stateid, cmd, ret);
 	return ret;
 }