| commit | 6d4e56ce977864b0fcd28c61555060e6010aa89b | |
| author | Jeff Layton <jlayton@redhat.com> | |
| Mon, 11 Jul 2016 13:10:06 +0000 (11 09:10 -0400) | ||
| committer | Al Viro <viro@zeniv.linux.org.uk> | |
| Mon, 11 Jul 2016 17:48:02 +0000 (11 13:48 -0400) | ||
| tree | 8b73f1e73b4461597b4d951c7f49c92b3bb000a0 | treesnapshot (tar.gz zip) |
| parent | c94c09535c4debcc439f55b5b6d9ebe57bd4665a | commitdiff |
posix_acl: de-union a_refcount and a_rcu
Currently the two are unioned together, but I don't think that's safe.
It looks like get_cached_acl could race with the last put in
posix_acl_release. get_cached_acl calls atomic_inc_not_zero on
a_refcount, but that field could have already been clobbered by
call_rcu, and may no longer be zero. Fix this by de-unioning the two
fields.
Fixes: b8a7a3a66747 (posix_acl: Inode acl caching fixes)
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Currently the two are unioned together, but I don't think that's safe.
It looks like get_cached_acl could race with the last put in
posix_acl_release. get_cached_acl calls atomic_inc_not_zero on
a_refcount, but that field could have already been clobbered by
call_rcu, and may no longer be zero. Fix this by de-unioning the two
fields.
Fixes: b8a7a3a66747 (posix_acl: Inode acl caching fixes)
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
| include/linux/posix_acl.h | diffblobblamehistory |