diff options
| author | J. Bruce Fields <bfields@citi.umich.edu> | 2008-02-20 14:02:47 -0500 |
|---|---|---|
| committer | J. Bruce Fields <bfields@citi.umich.edu> | 2008-04-23 16:13:39 -0400 |
| commit | 164f98adbbd50c67177b096a59f55c1a56a45c82 (patch) | |
| tree | baa47455b18219eca8ff4a54a84954170597fa06 /fs | |
| parent | dd35210e1e2cb46d6dba5c97f1bc3784c4f97998 (diff) | |
| download | linux-164f98adbbd50c67177b096a59f55c1a56a45c82.tar.bz2 | |
lockd: fix race in nlm_release()
The sm_count is decremented to zero but left on the nsm_handles list.
So in the space between decrementing sm_count and acquiring nsm_mutex,
it is possible for another task to find this nsm_handle, increment the
use count and then enter nsm_release itself.
Thus there's nothing to prevent the nsm being freed before we acquire
nsm_mutex here.
Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/lockd/host.c | 10 |
1 files changed, 4 insertions, 6 deletions
diff --git a/fs/lockd/host.c b/fs/lockd/host.c index c3f119426d83..960911c4a11c 100644 --- a/fs/lockd/host.c +++ b/fs/lockd/host.c @@ -529,12 +529,10 @@ nsm_release(struct nsm_handle *nsm) { if (!nsm) return; + mutex_lock(&nsm_mutex); if (atomic_dec_and_test(&nsm->sm_count)) { - mutex_lock(&nsm_mutex); - if (atomic_read(&nsm->sm_count) == 0) { - list_del(&nsm->sm_link); - kfree(nsm); - } - mutex_unlock(&nsm_mutex); + list_del(&nsm->sm_link); + kfree(nsm); } + mutex_unlock(&nsm_mutex); } |