From 5a11d4d0ee1ff284271f7265929d07ea4a1168a6 Mon Sep 17 00:00:00 2001 From: Ian Kent Date: Wed, 23 Jul 2008 21:30:17 -0700 Subject: autofs4: fix waitq locking The autofs4_catatonic_mode() function accesses the wait queue without any locking but can be called at any time. This could lead to a possible double free of the name field of the wait and a double fput of the daemon communication pipe or an fput of a NULL file pointer. Signed-off-by: Ian Kent Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- fs/autofs4/inode.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'fs/autofs4/inode.c') diff --git a/fs/autofs4/inode.c b/fs/autofs4/inode.c index e3e70994ab4..7bb3e5ba053 100644 --- a/fs/autofs4/inode.c +++ b/fs/autofs4/inode.c @@ -163,8 +163,8 @@ void autofs4_kill_sb(struct super_block *sb) if (!sbi) goto out_kill_sb; - if (!sbi->catatonic) - autofs4_catatonic_mode(sbi); /* Free wait queues, close pipe */ + /* Free wait queues, close pipe */ + autofs4_catatonic_mode(sbi); /* Clean up and release dangling references */ autofs4_force_release(sbi); -- cgit v1.2.3