projects
/
GitHub
/
LineageOS
/
G12
/
android_kernel_amlogic_linux-4.9.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
eda65cc
)
fix devtmpfs race
author
Al Viro
<viro@zeniv.linux.org.uk>
Mon, 25 Jul 2011 18:15:50 +0000
(14:15 -0400)
committer
Al Viro
<viro@zeniv.linux.org.uk>
Mon, 25 Jul 2011 18:15:50 +0000
(14:15 -0400)
After we's done complete(&req->done), there's nothing to prevent the
scope containing *req from being gone and *req overwritten by any
kind of junk. So we must read req->next before that...
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
drivers/base/devtmpfs.c
patch
|
blob
|
blame
|
history
diff --git
a/drivers/base/devtmpfs.c
b/drivers/base/devtmpfs.c
index 6d678c99512e383ea9c7dee9dd1c5519151768ef..b89fffc1d777b277abd7bac4221b0fbc98e265ff 100644
(file)
--- a/
drivers/base/devtmpfs.c
+++ b/
drivers/base/devtmpfs.c
@@
-406,9
+406,10
@@
static int devtmpfsd(void *p)
requests = NULL;
spin_unlock(&req_lock);
while (req) {
+ struct req *next = req->next;
req->err = handle(req->name, req->mode, req->dev);
complete(&req->done);
- req =
req->
next;
+ req = next;
}
spin_lock(&req_lock);
}