diff options
| author | Yihao Wu <wuyihao@linux.alibaba.com> | 2020-04-06 01:57:22 +0800 |
|---|---|---|
| committer | Chuck Lever <chuck.lever@oracle.com> | 2020-04-13 10:28:21 -0400 |
| commit | 43e33924c38e8faeb0c12035481cb150e602e39d (patch) | |
| tree | 2874c7b0edaf651e4804e165edf5a8c3789ca2f8 /net/sunrpc/svc_xprt.c | |
| parent | e1e8399eee72e9d5246d4d1bcacd793debe34dd3 (diff) | |
SUNRPC/cache: Fix unsafe traverse caused double-free in cache_purge
Deleting list entry within hlist_for_each_entry_safe is not safe unless
next pointer (tmp) is protected too. It's not, because once hash_lock
is released, cache_clean may delete the entry that tmp points to. Then
cache_purge can walk to a deleted entry and tries to double free it.
Fix this bug by holding only the deleted entry's reference.
Suggested-by: NeilBrown <neilb@suse.de>
Signed-off-by: Yihao Wu <wuyihao@linux.alibaba.com>
Reviewed-by: NeilBrown <neilb@suse.de>
[ cel: removed unused variable ]
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Diffstat (limited to 'net/sunrpc/svc_xprt.c')
0 files changed, 0 insertions, 0 deletions