Auke Kok dc74104804 Drain conn workers before nulling client->conn in destroy ...

scoutfs_client_destroy nulled client->conn before scoutfs_net_free_conn
had a chance to drain the conn's workqueue.  An in-flight proc_worker
running client_lock_recover dispatches scoutfs_lock_recover_request
synchronously, which in turn calls scoutfs_client_lock_recover_response.
That helper reads client->conn and hands it to scoutfs_net_response, so
a racing NULL made submit_send dereference conn->lock and trip a KASAN
null-ptr-deref followed by a GPF.

Only became reachable in practice once reconnect started draining pending
client requests with -ECONNRESET, because the farewell can now return
while the server is still sending requests on the re-established socket.

Reorder so scoutfs_net_free_conn runs first; its shutdown_worker drains
conn->workq before any memory is freed, then client->conn is nulled.
The original intent of nulling to catch buggy late callers is preserved.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-04-21 14:37:04 -07:00

..

src

Drain conn workers before nulling client->conn in destroy

2026-04-21 14:37:04 -07:00

.gitignore

scoutfs: update rpm building infrastructure

2018-09-14 15:07:10 -07:00

Makefile

Require sparse, and filter kernel sparse output

2025-10-03 09:35:36 -07:00

scoutfs-kmod.spec.in

Block EL9 minor version upgrades

2024-12-02 16:04:24 -08:00