From e13889bab3c6b5c839075086d28fe05f71984dda Mon Sep 17 00:00:00 2001 From: Al Viro Date: Mon, 25 Jul 2011 14:15:50 -0400 Subject: fix devtmpfs race After we's done complete(&req->done), there's nothing to prevent the scope containing *req from being gone and *req overwritten by any kind of junk. So we must read req->next before that... Signed-off-by: Al Viro --- drivers/base/devtmpfs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'drivers/base/devtmpfs.c') diff --git a/drivers/base/devtmpfs.c b/drivers/base/devtmpfs.c index 6d678c99512e..b89fffc1d777 100644 --- a/drivers/base/devtmpfs.c +++ b/drivers/base/devtmpfs.c @@ -406,9 +406,10 @@ static int devtmpfsd(void *p) requests = NULL; spin_unlock(&req_lock); while (req) { + struct req *next = req->next; req->err = handle(req->name, req->mode, req->dev); complete(&req->done); - req = req->next; + req = next; } spin_lock(&req_lock); } -- cgit v1.2.3-59-g8ed1b