| commit | 164f98adbbd50c67177b096a59f55c1a56a45c82 | [log] [tgz] |
|---|---|---|
| author | J. Bruce Fields <bfields@citi.umich.edu> | Wed Feb 20 14:02:47 2008 -0500 |
| committer | J. Bruce Fields <bfields@citi.umich.edu> | Wed Apr 23 16:13:39 2008 -0400 |
| tree | baa47455b18219eca8ff4a54a84954170597fa06 | |
| parent | dd35210e1e2cb46d6dba5c97f1bc3784c4f97998 [diff] |
lockd: fix race in nlm_release() The sm_count is decremented to zero but left on the nsm_handles list. So in the space between decrementing sm_count and acquiring nsm_mutex, it is possible for another task to find this nsm_handle, increment the use count and then enter nsm_release itself. Thus there's nothing to prevent the nsm being freed before we acquire nsm_mutex here. Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>