Files
scoutfs/kmod
Zach Brown 9cc750c4ec scoutfs: remove lock idr in free, not put
The idr entry that identifies a lock's position in the debugfs locks
file is allocated early in the process of building up a lock.  Today the
idr entry is only destroyed in put_(), which is called later once
reference counts are established.  Errors before then just call free_()
and can leave idrs around that reference freed memory.

This always destroys the idr entry in free_().  We no longer leave idr
entries around that reference freed memory.

This fixes use after free while walking the debugfs file which can hit
in scoutfs/006 which uses the locks file.

Signed-off-by: Zach Brown <zab@versity.com>
2018-01-30 11:04:47 -08:00
..