Re: [PATCH] sysfs & dput.

[Martin Schwidefsky]

Hi Pat,

> > there is another, small bug in sysfs. In sysfs_create_bin_file
> > dentry gets assigned the error value of the call to sysfs_create
> > if the call failed. The subsequent call to dput will crash. The
> > solution is to remove the assignment of the error to dentry.
>
> Thanks for the catch; Andrew Morton also posted a patch yesterday.
> However, your patch drops the error value, and his adds another variable.
> The patch below should be equivalent (and fixes the same problem for
> directories, too).
>
> Please test it, if you get a chance.

My patch fixes sysfs_create_bin_file which returns error and not the dentry,
the assignment to dentry is a dead assignment. But anyway I indeed missed
the second place where the dput is problematic. What I don't like about
the new patch is that dentry is accessed AFTER the dput. The chances are
slim but the dentry could have been deleted and if the dput drops the
reference count to zero you access an already freed structure.

blue skies,
   Martin


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/