[PATCH 4.14 22/50] NFS4: Fix use-after-free in trace_event_raw_event_nfs4_set_lock

[Greg Kroah-Hartman]

From: Dave Wysochanski <dwyso...@redhat.com>

commit 3d1a90ab0ed93362ec8ac85cf291243c87260c21 upstream.

It is only safe to call the tracepoint before rpc_put_task() because
'data' is freed inside nfs4_lock_release (rpc_release).

Fixes: 48c9579a1afe ("Adding stateid information to tracepoints")
Signed-off-by: Dave Wysochanski <dwyso...@redhat.com>
Signed-off-by: Trond Myklebust <trond.mykleb...@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---
 fs/nfs/nfs4proc.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -6395,9 +6395,9 @@ static int _nfs4_do_setlk(struct nfs4_st
                                        data->arg.new_lock_owner, ret);
        } else
                data->cancelled = true;
+       trace_nfs4_set_lock(fl, state, &data->res.stateid, cmd, ret);
        rpc_put_task(task);
        dprintk("%s: done, ret = %d!\n", __func__, ret);
-       trace_nfs4_set_lock(fl, state, &data->res.stateid, cmd, ret);
        return ret;
 }