summaryrefslogtreecommitdiff
path: root/drivers/base/devtmpfs.c
diff options
context:
space:
mode:
authorAl Viro <viro@zeniv.linux.org.uk>2011-07-25 22:15:50 +0400
committerAl Viro <viro@zeniv.linux.org.uk>2011-07-25 22:15:50 +0400
commite13889bab3c6b5c839075086d28fe05f71984dda (patch)
tree4b2931575f48186533848f36a7c80809ea929097 /drivers/base/devtmpfs.c
parenteda65cc6ce2a45dc01c233e301e59cd7a0f763ad (diff)
downloadlinux-e13889bab3c6b5c839075086d28fe05f71984dda.tar.xz
fix devtmpfs race
After we's done complete(&req->done), there's nothing to prevent the scope containing *req from being gone and *req overwritten by any kind of junk. So we must read req->next before that... Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'drivers/base/devtmpfs.c')
-rw-r--r--drivers/base/devtmpfs.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/base/devtmpfs.c b/drivers/base/devtmpfs.c
index 6d678c99512e..b89fffc1d777 100644
--- a/drivers/base/devtmpfs.c
+++ b/drivers/base/devtmpfs.c
@@ -406,9 +406,10 @@ static int devtmpfsd(void *p)
requests = NULL;
spin_unlock(&req_lock);
while (req) {
+ struct req *next = req->next;
req->err = handle(req->name, req->mode, req->dev);
complete(&req->done);
- req = req->next;
+ req = next;
}
spin_lock(&req_lock);
}