Commit 164f98ad authored by J. Bruce Fields's avatar J. Bruce Fields

lockd: fix race in nlm_release()

The sm_count is decremented to zero but left on the nsm_handles list.
So in the space between decrementing sm_count and acquiring nsm_mutex,
it is possible for another task to find this nsm_handle, increment the
use count and then enter nsm_release itself.

Thus there's nothing to prevent the nsm being freed before we acquire
nsm_mutex here.
Signed-off-by: default avatarJ. Bruce Fields <bfields@citi.umich.edu>
parent dd35210e
......@@ -529,12 +529,10 @@ nsm_release(struct nsm_handle *nsm)
{
if (!nsm)
return;
mutex_lock(&nsm_mutex);
if (atomic_dec_and_test(&nsm->sm_count)) {
mutex_lock(&nsm_mutex);
if (atomic_read(&nsm->sm_count) == 0) {
list_del(&nsm->sm_link);
kfree(nsm);
}
mutex_unlock(&nsm_mutex);
list_del(&nsm->sm_link);
kfree(nsm);
}
mutex_unlock(&nsm_mutex);
}
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment