Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ce5246b9 authored by David Teigland's avatar David Teigland
Browse files

dlm: fix possible use-after-free 



The dlm_put_lkb() can free the lkb and its associated ua structure,
so we can't depend on using the ua struct after the put.

Signed-off-by: default avatarDavid Teigland <teigland@redhat.com>
parent 755b5eb8

fs/dlm/user.c

+2 −2
Original line number Diff line number Diff line
@@ -236,12 +236,12 @@ void dlm_user_add_ast(struct dlm_lkb *lkb, int type) 
	spin_unlock(&proc->asts_spin);



	if (eol) {

		spin_lock(&ua->proc->locks_spin);

		spin_lock(&proc->locks_spin);

		if (!list_empty(&lkb->lkb_ownqueue)) {

			list_del_init(&lkb->lkb_ownqueue);

			dlm_put_lkb(lkb);

		}

		spin_unlock(&ua->proc->locks_spin);

		spin_unlock(&proc->locks_spin);

	}

 out:

	mutex_unlock(&ls->ls_clear_proc_locks);