Al Viro 8753333266 autofs4: catatonic_mode vs. notify_daemon race ...

we need to hold ->wq_mutex while we are forming the packet to send,
lest we have autofs4_catatonic_mode() setting wq->name.name to NULL
just as autofs4_notify_daemon() decides to memcpy() from it...

We do have check for catatonic mode immediately after that (under
->wq_mutex, as it ought to be) and packet won't be actually sent,
but it'll be too late for us if we oops on that memcpy() from NULL...

Fix is obvious - just extend the area covered by ->wq_mutex over
that switch and check whether it's catatonic *before* doing anything
else.

Acked-by: Ian Kent <raven@themaw.net>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

2012-01-11 00:19:58 -05:00

..

autofs_i.h

autofs4: propagate umode_t

2012-01-03 22:55:10 -05:00

dev-ioctl.c

vfs: prefer ->dentry->d_sb to ->mnt->mnt_sb

2012-01-06 23:16:53 -05:00

expire.c

autofs4 - remove autofs4_lock

2011-03-24 14:54:35 -04:00

init.c

…

inode.c

vfs: switch ->show_options() to struct dentry *

2012-01-06 23:19:54 -05:00

Kconfig

…

Makefile

…

root.c

switch vfs_mkdir() and ->mkdir() to umode_t

2012-01-03 22:54:53 -05:00

symlink.c

…

waitq.c

autofs4: catatonic_mode vs. notify_daemon race

2012-01-11 00:19:58 -05:00