diff options
| author | Yihao Wu <[email protected]> | 2020-04-06 01:57:22 +0800 |
|---|---|---|
| committer | Chuck Lever <[email protected]> | 2020-04-13 10:28:21 -0400 |
| commit | 43e33924c38e8faeb0c12035481cb150e602e39d (patch) | |
| tree | 2874c7b0edaf651e4804e165edf5a8c3789ca2f8 /tools/perf/scripts/python/export-to-sqlite.py | |
| parent | e1e8399eee72e9d5246d4d1bcacd793debe34dd3 (diff) | |
SUNRPC/cache: Fix unsafe traverse caused double-free in cache_purge
Deleting list entry within hlist_for_each_entry_safe is not safe unless
next pointer (tmp) is protected too. It's not, because once hash_lock
is released, cache_clean may delete the entry that tmp points to. Then
cache_purge can walk to a deleted entry and tries to double free it.
Fix this bug by holding only the deleted entry's reference.
Suggested-by: NeilBrown <[email protected]>
Signed-off-by: Yihao Wu <[email protected]>
Reviewed-by: NeilBrown <[email protected]>
[ cel: removed unused variable ]
Signed-off-by: Chuck Lever <[email protected]>
Diffstat (limited to 'tools/perf/scripts/python/export-to-sqlite.py')
0 files changed, 0 insertions, 0 deletions