diff options
author | Al Viro <viro@zeniv.linux.org.uk> | 2011-07-25 20:15:50 +0200 |
---|---|---|
committer | Al Viro <viro@zeniv.linux.org.uk> | 2011-07-25 20:15:50 +0200 |
commit | e13889bab3c6b5c839075086d28fe05f71984dda (patch) | |
tree | 4b2931575f48186533848f36a7c80809ea929097 /drivers/base/devtmpfs.c | |
parent | caam: don't pass bogus S_IFCHR to debugfs_create_...() (diff) | |
download | linux-e13889bab3c6b5c839075086d28fe05f71984dda.tar.xz linux-e13889bab3c6b5c839075086d28fe05f71984dda.zip |
fix devtmpfs race
After we's done complete(&req->done), there's nothing to prevent the
scope containing *req from being gone and *req overwritten by any
kind of junk. So we must read req->next before that...
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to '')
-rw-r--r-- | drivers/base/devtmpfs.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/base/devtmpfs.c b/drivers/base/devtmpfs.c index 6d678c99512e..b89fffc1d777 100644 --- a/drivers/base/devtmpfs.c +++ b/drivers/base/devtmpfs.c @@ -406,9 +406,10 @@ static int devtmpfsd(void *p) requests = NULL; spin_unlock(&req_lock); while (req) { + struct req *next = req->next; req->err = handle(req->name, req->mode, req->dev); complete(&req->done); - req = req->next; + req = next; } spin_lock(&req_lock); } |