[LU-19453] use-after-free of lov_stripe_md

• Type: Bug
• Resolution: Unresolved
• Priority: Medium
• Severity: 3
• Assignee: Shaun Tancheff
• Reporter: Shaun Tancheff

Description

With the conversion to kref() a LASSERT() that prevented a UAF
was removed. However some callers of lsm_addref() handled this
case gracefully so the LASSERT() was not in the correct location.

Remove the UAF race with kref_get_unless_zero() and returning NULL.
Callers which cannot gracefully handle the UAF path should LASSERT()