summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDavid Teigland <teigland@redhat.com>2008-01-15 00:48:58 +0300
committerDavid Teigland <teigland@redhat.com>2008-01-30 20:04:42 +0300
commitce5246b972f7514af899a63c0faf831d05ed5ee1 (patch)
treefe7c58c280bde924f88adf5da2620ecf433293bd
parent755b5eb8bac90b35dc901465a06081aaad94e9ae (diff)
downloadlinux-ce5246b972f7514af899a63c0faf831d05ed5ee1.tar.xz
dlm: fix possible use-after-free
The dlm_put_lkb() can free the lkb and its associated ua structure, so we can't depend on using the ua struct after the put. Signed-off-by: David Teigland <teigland@redhat.com>
-rw-r--r--fs/dlm/user.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/fs/dlm/user.c b/fs/dlm/user.c
index 4f741546f4bb..eb6164816948 100644
--- a/fs/dlm/user.c
+++ b/fs/dlm/user.c
@@ -236,12 +236,12 @@ void dlm_user_add_ast(struct dlm_lkb *lkb, int type)
spin_unlock(&proc->asts_spin);
if (eol) {
- spin_lock(&ua->proc->locks_spin);
+ spin_lock(&proc->locks_spin);
if (!list_empty(&lkb->lkb_ownqueue)) {
list_del_init(&lkb->lkb_ownqueue);
dlm_put_lkb(lkb);
}
- spin_unlock(&ua->proc->locks_spin);
+ spin_unlock(&proc->locks_spin);
}
out:
mutex_unlock(&ls->ls_clear_proc_locks);