Revision f818a73674c5d197f66b636a46d7d578d7258129 authored by Sage Weil on 12 May 2010, 03:56:31 UTC, committed by Sage Weil on 12 May 2010, 03:56:31 UTC
The iterate_session_caps helper traverses the session caps list and tries to grab an inode reference. However, the __ceph_remove_cap was clearing the inode backpointer _before_ removing itself from the session list, causing a null pointer dereference. Clear cap->ci under protection of s_cap_lock to avoid the race, and to tightly couple the list and backpointer state. Use a local flag to indicate whether we are releasing the cap, as cap->session may be modified by a racing thread in iterate_session_caps. Signed-off-by: Sage Weil <sage@newdream.net>
1 parent 45c6ceb
| File | Mode | Size |
|---|---|---|
| integrity | ||
| keys | ||
| selinux | ||
| smack | ||
| tomoyo | ||
| Kconfig | -rw-r--r-- | 6.2 KB |
| Makefile | -rw-r--r-- | 835 bytes |
| capability.c | -rw-r--r-- | 24.4 KB |
| commoncap.c | -rw-r--r-- | 26.6 KB |
| device_cgroup.c | -rw-r--r-- | 11.8 KB |
| inode.c | -rw-r--r-- | 8.7 KB |
| lsm_audit.c | -rw-r--r-- | 8.7 KB |
| min_addr.c | -rw-r--r-- | 1.3 KB |
| security.c | -rw-r--r-- | 33.5 KB |
Computing file changes ...
