dlm: fix possible use-after-free
authorDavid Teigland <teigland@redhat.com>
Mon, 14 Jan 2008 21:48:58 +0000 (15:48 -0600)
committerDavid Teigland <teigland@redhat.com>
Wed, 30 Jan 2008 17:04:42 +0000 (11:04 -0600)
The dlm_put_lkb() can free the lkb and its associated ua structure,
so we can't depend on using the ua struct after the put.

Signed-off-by: David Teigland <teigland@redhat.com>
fs/dlm/user.c

index 4f741546f4bbce873079bee9060eac437934d8b6..eb616481694848a4a6d8cfef98520a9a64ce7f47 100644 (file)
@@ -236,12 +236,12 @@ void dlm_user_add_ast(struct dlm_lkb *lkb, int type)
        spin_unlock(&proc->asts_spin);
 
        if (eol) {
-               spin_lock(&ua->proc->locks_spin);
+               spin_lock(&proc->locks_spin);
                if (!list_empty(&lkb->lkb_ownqueue)) {
                        list_del_init(&lkb->lkb_ownqueue);
                        dlm_put_lkb(lkb);
                }
-               spin_unlock(&ua->proc->locks_spin);
+               spin_unlock(&proc->locks_spin);
        }
  out:
        mutex_unlock(&ls->ls_clear_proc_locks);