diff options
| author | Yihao Wu <wuyihao@linux.alibaba.com> | 2020-04-06 01:57:22 +0800 |
|---|---|---|
| committer | Chuck Lever <chuck.lever@oracle.com> | 2020-04-13 10:28:21 -0400 |
| commit | 43e33924c38e8faeb0c12035481cb150e602e39d (patch) | |
| tree | 2874c7b0edaf651e4804e165edf5a8c3789ca2f8 /fs | |
| parent | e1e8399eee72e9d5246d4d1bcacd793debe34dd3 (diff) | |
| download | linux-43e33924c38e8faeb0c12035481cb150e602e39d.tar.gz | |
SUNRPC/cache: Fix unsafe traverse caused double-free in cache_purge
Deleting list entry within hlist_for_each_entry_safe is not safe unless next pointer (tmp) is protected too. It's not, because once hash_lock is released, cache_clean may delete the entry that tmp points to. Then cache_purge can walk to a deleted entry and tries to double free it. Fix this bug by holding only the deleted entry's reference. Suggested-by: NeilBrown <neilb@suse.de> Signed-off-by: Yihao Wu <wuyihao@linux.alibaba.com> Reviewed-by: NeilBrown <neilb@suse.de> [ cel: removed unused variable ] Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Diffstat (limited to 'fs')
0 files changed, 0 insertions, 0 deletions