From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Teigland Date: Mon, 21 Jan 2008 16:25:41 -0600 Subject: [Cluster-devel] [PATCH] dlm: fix possible use-after-free Message-ID: <1200954344-17298-17-git-send-email-teigland@redhat.com> List-Id: To: cluster-devel.redhat.com MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit The dlm_put_lkb() can free the lkb and its associated ua structure, so we can't depend on using the ua struct after the put. Signed-off-by: David Teigland --- fs/dlm/user.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/dlm/user.c b/fs/dlm/user.c index 4f74154..eb61648 100644 --- a/fs/dlm/user.c +++ b/fs/dlm/user.c @@ -236,12 +236,12 @@ void dlm_user_add_ast(struct dlm_lkb *lkb, int type) spin_unlock(&proc->asts_spin); if (eol) { - spin_lock(&ua->proc->locks_spin); + spin_lock(&proc->locks_spin); if (!list_empty(&lkb->lkb_ownqueue)) { list_del_init(&lkb->lkb_ownqueue); dlm_put_lkb(lkb); } - spin_unlock(&ua->proc->locks_spin); + spin_unlock(&proc->locks_spin); } out: mutex_unlock(&ls->ls_clear_proc_locks); -- 1.5.3.3