Both bugs are triggered when nlmclnt_find_lockowner() returns NULL
due to allocation failure in nlmclnt_proc():

Patch 1 fixes a NULL pointer dereference: nlmclnt_locks_init_private()
unconditionally sets fl->fl_ops before checking whether owner is NULL,
so locks_release_private() later calls fl_release_private which
dereferences the NULL owner. Fix by inlining the function so that
fl_ops is only set after the owner is valid.

Patch 2 fixes a reference leak: call->a_callback_data has not been
assigned when nlmclnt_release_call() is invoked on the error path,
so nlmclnt_ops->nlmclnt_release_call(NULL) skips cleanup and the
references taken by nlmclnt_alloc_call() are never freed. Fix by
moving the assignment before the lockowner check.

Ran Hongyun (2):
  lockd: fix NULL pointer dereference in nlmclnt_locks_release_private
  lockd: fix reference leak on lockowner allocation failure in
    nlmclnt_proc

 fs/lockd/clntproc.c | 19 +++++++------------
 1 file changed, 7 insertions(+), 12 deletions(-)

-- 
2.52.0

On Wed, 2026-08-19 at 15:46 +0800, Ran Hongyun wrote:
> Both bugs are triggered when nlmclnt_find_lockowner() returns NULL
> due to allocation failure in nlmclnt_proc():
> 
> Patch 1 fixes a NULL pointer dereference: nlmclnt_locks_init_private()
> unconditionally sets fl->fl_ops before checking whether owner is NULL,
> so locks_release_private() later calls fl_release_private which
> dereferences the NULL owner. Fix by inlining the function so that
> fl_ops is only set after the owner is valid.
> 
> Patch 2 fixes a reference leak: call->a_callback_data has not been
> assigned when nlmclnt_release_call() is invoked on the error path,
> so nlmclnt_ops->nlmclnt_release_call(NULL) skips cleanup and the
> references taken by nlmclnt_alloc_call() are never freed. Fix by
> moving the assignment before the lockowner check.
> 
> Ran Hongyun (2):
>   lockd: fix NULL pointer dereference in nlmclnt_locks_release_private
>   lockd: fix reference leak on lockowner allocation failure in
>     nlmclnt_proc
> 
>  fs/lockd/clntproc.c | 19 +++++++------------
>  1 file changed, 7 insertions(+), 12 deletions(-)

To be clear, these are client-side patches. Anna/Trond, can you pick
these up?

Thanks,
-- 
Jeff Layton <jlayton@kernel.org>

Friendly ping.

nit: usually when you send a new version of a patchset you should
declare it as "v2". So "PATCH v2 0/2", etc...

Using the b4 command makes this easy to track.

On Wed, 2026-08-19 at 15:46 +0800, Ran Hongyun wrote:
> Both bugs are triggered when nlmclnt_find_lockowner() returns NULL
> due to allocation failure in nlmclnt_proc():
> 
> Patch 1 fixes a NULL pointer dereference: nlmclnt_locks_init_private()
> unconditionally sets fl->fl_ops before checking whether owner is NULL,
> so locks_release_private() later calls fl_release_private which
> dereferences the NULL owner. Fix by inlining the function so that
> fl_ops is only set after the owner is valid.
> 
> Patch 2 fixes a reference leak: call->a_callback_data has not been
> assigned when nlmclnt_release_call() is invoked on the error path,
> so nlmclnt_ops->nlmclnt_release_call(NULL) skips cleanup and the
> references taken by nlmclnt_alloc_call() are never freed. Fix by
> moving the assignment before the lockowner check.
> 
> Ran Hongyun (2):
>   lockd: fix NULL pointer dereference in nlmclnt_locks_release_private
>   lockd: fix reference leak on lockowner allocation failure in
>     nlmclnt_proc
> 
>  fs/lockd/clntproc.c | 19 +++++++------------
>  1 file changed, 7 insertions(+), 12 deletions(-)

New version looks good. Note it looks like Shuangpeng Bai sent a less
complete patch for this problem back in July that I just noticed. Your
version seems more correct though.

Reviewed-by: Jeff Layton <jlayton@kernel.org>