From: David Howells dhowells@redhat.com
commit 9efcc4a129363187c9bf15338692f107c5c9b6f0 upstream.
When it's probing all of a fileserver's interfaces to find which one is best to use, afs_do_probe_fileserver() takes a lock on the server record and notes the pointer to the address list.
It doesn't, however, pin the address list, so as soon as it drops the lock, there's nothing to stop the address list from being freed under us.
Fix this by taking a ref on the address list inside the locked section and dropping it at the end of the function.
Fixes: 3bf0fb6f33dd ("afs: Probe multiple fileservers simultaneously") Signed-off-by: David Howells dhowells@redhat.com Reviewed-by: Marc Dionne marc.dionne@auristor.com Signed-off-by: Linus Torvalds torvalds@linux-foundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
--- fs/afs/fs_probe.c | 2 ++ 1 file changed, 2 insertions(+)
--- a/fs/afs/fs_probe.c +++ b/fs/afs/fs_probe.c @@ -145,6 +145,7 @@ static int afs_do_probe_fileserver(struc read_lock(&server->fs_lock); ac.alist = rcu_dereference_protected(server->addresses, lockdep_is_held(&server->fs_lock)); + afs_get_addrlist(ac.alist); read_unlock(&server->fs_lock);
atomic_set(&server->probe_outstanding, ac.alist->nr_addrs); @@ -163,6 +164,7 @@ static int afs_do_probe_fileserver(struc
if (!in_progress) afs_fs_probe_done(server); + afs_put_addrlist(ac.alist); return in_progress; }