Commit 6d4e56ce authored by Jeff Layton's avatar Jeff Layton Committed by Al Viro

posix_acl: de-union a_refcount and a_rcu

Currently the two are unioned together, but I don't think that's safe.

It looks like get_cached_acl could race with the last put in
posix_acl_release. get_cached_acl calls atomic_inc_not_zero on
a_refcount, but that field could have already been clobbered by
call_rcu, and may no longer be zero. Fix this by de-unioning the two
fields.

Fixes: b8a7a3a6 (posix_acl: Inode acl caching fixes)
Signed-off-by: default avatarJeff Layton <jlayton@redhat.com>
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent c94c0953
......@@ -43,10 +43,8 @@ struct posix_acl_entry {
};
struct posix_acl {
union {
atomic_t a_refcount;
struct rcu_head a_rcu;
};
atomic_t a_refcount;
struct rcu_head a_rcu;
unsigned int a_count;
struct posix_acl_entry a_entries[0];
};
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment