luck/tmp_suning_uos_patched
1
0
Fork 1
Code Issues Pull Requests Packages Projects Releases Wiki Activity

lockd: fix race in nlm_release()

Browse Source 
The sm_count is decremented to zero but left on the nsm_handles list.
So in the space between decrementing sm_count and acquiring nsm_mutex,
it is possible for another task to find this nsm_handle, increment the
use count and then enter nsm_release itself.

Thus there's nothing to prevent the nsm being freed before we acquire
nsm_mutex here.

Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
This commit is contained in:
J. Bruce Fields 2008-02-20 14:02:47 -05:00
parent dd35210e1e
commit 164f98adbb
1 changed files with 4 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
fs/lockd/host.c
View File

@ -529,12 +529,10 @@ nsm_release(struct nsm_handle *nsm)
{ {
if (!nsm) if (!nsm)
return; return;
mutex_lock(&nsm_mutex);
if (atomic_dec_and_test(&nsm->sm_count)) { if (atomic_dec_and_test(&nsm->sm_count)) {
mutex_lock(&nsm_mutex); list_del(&nsm->sm_link);
if (atomic_read(&nsm->sm_count) == 0) { kfree(nsm);
list_del(&nsm->sm_link);
kfree(nsm);
}
mutex_unlock(&nsm_mutex);
} }
mutex_unlock(&nsm_mutex);
} }