Commit 6d4e56ce authored Jul 11, 2016 by Jeff Layton Committed by Al Viro Jul 11, 2016

posix_acl: de-union a_refcount and a_rcu



Currently the two are unioned together, but I don't think that's safe.

It looks like get_cached_acl could race with the last put in
posix_acl_release. get_cached_acl calls atomic_inc_not_zero on
a_refcount, but that field could have already been clobbered by
call_rcu, and may no longer be zero. Fix this by de-unioning the two
fields.

Fixes: b8a7a3a6 (posix_acl: Inode acl caching fixes)
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

parent c94c0953

include/linux/posix_acl.h

+2 −4

Original line number	Diff line number	Diff line
		@@ -43,10 +43,8 @@ struct posix_acl_entry {
		};

		struct posix_acl {
		union {
		atomic_t a_refcount;
		struct rcu_head a_rcu;
		};
		unsigned int a_count;
		struct posix_acl_entry a_entries[0];
		};