lkml.org 
[lkml]   [2008]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 16/19] dlm: fix possible use-after-free
    Date
    The dlm_put_lkb() can free the lkb and its associated ua structure,
    so we can't depend on using the ua struct after the put.

    Signed-off-by: David Teigland <teigland@redhat.com>
    ---
    fs/dlm/user.c | 4 ++--
    1 files changed, 2 insertions(+), 2 deletions(-)

    diff --git a/fs/dlm/user.c b/fs/dlm/user.c
    index 4f74154..eb61648 100644
    --- a/fs/dlm/user.c
    +++ b/fs/dlm/user.c
    @@ -236,12 +236,12 @@ void dlm_user_add_ast(struct dlm_lkb *lkb, int type)
    spin_unlock(&proc->asts_spin);

    if (eol) {
    - spin_lock(&ua->proc->locks_spin);
    + spin_lock(&proc->locks_spin);
    if (!list_empty(&lkb->lkb_ownqueue)) {
    list_del_init(&lkb->lkb_ownqueue);
    dlm_put_lkb(lkb);
    }
    - spin_unlock(&ua->proc->locks_spin);
    + spin_unlock(&proc->locks_spin);
    }
    out:
    mutex_unlock(&ls->ls_clear_proc_locks);
    --
    1.5.3.3


    \
     
     \ /
      Last update: 2008-01-24 18:09    [W:0.034 / U:1.180 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site