• Al Viro's avatar
    autofs4: catatonic_mode vs. notify_daemon race · 87533332
    Al Viro authored
    we need to hold ->wq_mutex while we are forming the packet to send,
    lest we have autofs4_catatonic_mode() setting wq->name.name to NULL
    just as autofs4_notify_daemon() decides to memcpy() from it...
    
    We do have check for catatonic mode immediately after that (under
    ->wq_mutex, as it ought to be) and packet won't be actually sent,
    but it'll be too late for us if we oops on that memcpy() from NULL...
    
    Fix is obvious - just extend the area covered by ->wq_mutex over
    that switch and check whether it's catatonic *before* doing anything
    else.
    Acked-by: default avatarIan Kent <raven@themaw.net>
    Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
    87533332
waitq.c 13.8 KB