kpriv/linux-hardened
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

dlm: fix plock use-after-free

Browse source 
Fix a regression from the original addition of nfs lock support
586759f03e.  When a synchronous
(non-nfs) plock completes, the waiting thread will wake up and
free the op struct.  This races with the user thread in
dev_write() which goes on to read the op's callback field to
check if the lock is async and needs a callback.  This check
can happen on the freed op.  The fix is to note the callback
value before the op can be freed.

Signed-off-by: David Teigland <teigland@redhat.com>
This commit is contained in:
David Teigland 2009-06-18 13:20:24 -05:00
parent a566a6b11c
commit c78a87d0a1
1 changed files with 10 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
fs/dlm/plock.c
View file

@ -353,7 +353,7 @@ static ssize_t dev_write(struct file *file, const char __user *u, size_t count,
{
struct dlm_plock_info info;
struct plock_op *op;
int found = 0;
int found = 0, do_callback = 0;
if (count != sizeof(info))
return -EINVAL;
@ -366,21 +366,24 @@ static ssize_t dev_write(struct file *file, const char __user *u, size_t count,
spin_lock(&ops_lock);
list_for_each_entry(op, &recv_list, list) {
if (op->info.fsid == info.fsid && op->info.number == info.number &&
if (op->info.fsid == info.fsid &&
op->info.number == info.number &&
op->info.owner == info.owner) {
struct plock_xop *xop = (struct plock_xop *)op;
list_del_init(&op->list);
found = 1;
op->done = 1;
memcpy(&op->info, &info, sizeof(info));
if (xop->callback)
do_callback = 1;
else
op->done = 1;
found = 1;
break;
}
}
spin_unlock(&ops_lock);
if (found) {
struct plock_xop *xop;
xop = (struct plock_xop *)op;
if (xop->callback)
if (do_callback)
dlm_plock_callback(op);
else
wake_up(&recv_wq);