Attachment 314041 Details for Bug 458755 – Upstream patch for this issue

[patch] Upstream patch for this issue

0001-dlm-fix-possible-use-after-free.patch (text/plain), 1017 bytes, created by Eugene Teo (Security Response) on 2008-08-12 04:06:19 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Eugene Teo (Security Response)

Created: 2008-08-12 04:06:19 UTC

Size: 1017 bytes

patch

obsolete

>From ce5246b972f7514af899a63c0faf831d05ed5ee1 Mon Sep 17 00:00:00 2001
>From: David Teigland <teigland@redhat.com>
>Date: Mon, 14 Jan 2008 15:48:58 -0600
>Subject: [PATCH] dlm: fix possible use-after-free
>
>The dlm_put_lkb() can free the lkb and its associated ua structure,
>so we can't depend on using the ua struct after the put.
>
>Signed-off-by: David Teigland <teigland@redhat.com>
>---
> fs/dlm/user.c |    4 ++--
> 1 files changed, 2 insertions(+), 2 deletions(-)
>
>diff --git a/fs/dlm/user.c b/fs/dlm/user.c
>index 4f74154..eb61648 100644
>--- a/fs/dlm/user.c
>+++ b/fs/dlm/user.c
>@@ -236,12 +236,12 @@ void dlm_user_add_ast(struct dlm_lkb *lkb, int type)
> 	spin_unlock(&proc->asts_spin);
> 
> 	if (eol) {
>-		spin_lock(&ua->proc->locks_spin);
>+		spin_lock(&proc->locks_spin);
> 		if (!list_empty(&lkb->lkb_ownqueue)) {
> 			list_del_init(&lkb->lkb_ownqueue);
> 			dlm_put_lkb(lkb);
> 		}
>-		spin_unlock(&ua->proc->locks_spin);
>+		spin_unlock(&proc->locks_spin);
> 	}
>  out:
> 	mutex_unlock(&ls->ls_clear_proc_locks);
>-- 
>1.5.5.1
>

Actions: View | Diff

Attachments on bug 458755: 314041