[PATCH] fs/locks.c: Fix sys_flock() race
commitcad6178cd651b9604dc9433407a5be8ed71c4914
authorTrond Myklebust <Trond.Myklebust@netapp.com>
Fri, 31 Mar 2006 10:30:55 +0000 (31 02:30 -0800)
committerChris Wright <chrisw@sous-sol.org>
Sat, 20 May 2006 22:00:29 +0000 (20 15:00 -0700)
tree5c87a6bbef5e828460420f11bdbfc7ae20fc8ce2
parent572ae685ec6f034eedf34e9dc90fa8d904bcfc32
[PATCH] fs/locks.c: Fix sys_flock() race

sys_flock() currently has a race which can result in a double free in the
multi-thread case.

Thread 1 Thread 2

sys_flock(file, LOCK_EX)
sys_flock(file, LOCK_UN)

If Thread 2 removes the lock from inode->i_lock before Thread 1 tests for
list_empty(&lock->fl_link) at the end of sys_flock, then both threads will
end up calling locks_free_lock for the same lock.

Fix is to make flock_lock_file() do the same as posix_lock_file(), namely
to make a copy of the request, so that the caller can always free the lock.

This also has the side-effect of fixing up a reference problem in the
lockd handling of flock.

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
fs/locks.c