diff options
| author |   Yihao Wu <wuyihao@linux.alibaba.com> | 2020-04-06 01:57:22 +0800 |
|---|---|---|
| committer |   Chuck Lever <chuck.lever@oracle.com> | 2020-04-13 10:28:21 -0400 |
| commit | 43e33924c38e8faeb0c12035481cb150e602e39d (patch) | |
| tree | 2874c7b0edaf651e4804e165edf5a8c3789ca2f8 /tools/perf/scripts/python/export-to-postgresql.py | |
| parent | nfsd: memory corruption in nfsd4_lock() (diff) | |
| download | wireguard-linux-43e33924c38e8faeb0c12035481cb150e602e39d.tar.xz wireguard-linux-43e33924c38e8faeb0c12035481cb150e602e39d.zip | |
SUNRPC/cache: Fix unsafe traverse caused double-free in cache_purge
Deleting list entry within hlist_for_each_entry_safe is not safe unless
next pointer (tmp) is protected too. It's not, because once hash_lock
is released, cache_clean may delete the entry that tmp points to. Then
cache_purge can walk to a deleted entry and tries to double free it.
Fix this bug by holding only the deleted entry's reference.
Suggested-by: NeilBrown <neilb@suse.de>
Signed-off-by: Yihao Wu <wuyihao@linux.alibaba.com>
Reviewed-by: NeilBrown <neilb@suse.de>
[ cel: removed unused variable ]
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Diffstat (limited to '')
0 files changed, 0 insertions, 0 deletions