diff options
| author |   David Teigland <teigland@redhat.com> | 2008-01-14 15:48:58 -0600 |
|---|---|---|
| committer | David Teigland <teigland@redhat.com> | 2008-01-30 11:04:42 -0600 |
| commit | ce5246b972f7514af899a63c0faf831d05ed5ee1 (patch) | |
| tree | fe7c58c280bde924f88adf5da2620ecf433293bd /fs/dlm | |
| parent | dlm: limit dir lookup loop (diff) | |
| download | linux-dev-ce5246b972f7514af899a63c0faf831d05ed5ee1.tar.xz linux-dev-ce5246b972f7514af899a63c0faf831d05ed5ee1.zip | |
dlm: fix possible use-after-free
The dlm_put_lkb() can free the lkb and its associated ua structure,
so we can't depend on using the ua struct after the put.
Signed-off-by: David Teigland <teigland@redhat.com>
Diffstat (limited to 'fs/dlm')
| -rw-r--r-- | fs/dlm/user.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/fs/dlm/user.c b/fs/dlm/user.c index 4f741546f4bb..eb6164816948 100644 --- a/fs/dlm/user.c +++ b/fs/dlm/user.c @@ -236,12 +236,12 @@ void dlm_user_add_ast(struct dlm_lkb *lkb, int type) spin_unlock(&proc->asts_spin); if (eol) { - spin_lock(&ua->proc->locks_spin); + spin_lock(&proc->locks_spin); if (!list_empty(&lkb->lkb_ownqueue)) { list_del_init(&lkb->lkb_ownqueue); dlm_put_lkb(lkb); } - spin_unlock(&ua->proc->locks_spin); + spin_unlock(&proc->locks_spin); } out: mutex_unlock(&ls->ls_clear_proc_locks); |