The patch titled autofs4: fix waitq locking has been added to the -mm tree. Its filename is autofs4-fix-waitq-locking.patch Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/SubmitChecklist when testing your code *** See http://www.zip.com.au/~akpm/linux/patches/stuff/added-to-mm.txt to find out what to do about this The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/ ------------------------------------------------------ Subject: autofs4: fix waitq locking From: Ian Kent <raven@xxxxxxxxxx> The autofs4_catatonic_mode() function accesses the wait queue without any locking but can be called at any time. This could lead to a possible double free of the name field of the wait and a double fput of the daemon communication pipe or an fput of a NULL file pointer. Signed-off-by: Ian Kent <raven@xxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- fs/autofs4/inode.c | 4 ++-- fs/autofs4/waitq.c | 23 ++++++++++++----------- 2 files changed, 14 insertions(+), 13 deletions(-) diff -puN fs/autofs4/inode.c~autofs4-fix-waitq-locking fs/autofs4/inode.c --- a/fs/autofs4/inode.c~autofs4-fix-waitq-locking +++ a/fs/autofs4/inode.c @@ -163,8 +163,8 @@ void autofs4_kill_sb(struct super_block if (!sbi) goto out_kill_sb; - if (!sbi->catatonic) - autofs4_catatonic_mode(sbi); /* Free wait queues, close pipe */ + /* Free wait queues, close pipe */ + autofs4_catatonic_mode(sbi); /* Clean up and release dangling references */ autofs4_force_release(sbi); diff -puN fs/autofs4/waitq.c~autofs4-fix-waitq-locking fs/autofs4/waitq.c --- a/fs/autofs4/waitq.c~autofs4-fix-waitq-locking +++ a/fs/autofs4/waitq.c @@ -28,6 +28,12 @@ void autofs4_catatonic_mode(struct autof { struct autofs_wait_queue *wq, *nwq; + mutex_lock(&sbi->wq_mutex); + if (sbi->catatonic) { + mutex_unlock(&sbi->wq_mutex); + return; + } + DPRINTK("entering catatonic mode"); sbi->catatonic = 1; @@ -45,6 +51,8 @@ void autofs4_catatonic_mode(struct autof } fput(sbi->pipe); /* Close the pipe */ sbi->pipe = NULL; + sbi->pipefd = -1; + mutex_unlock(&sbi->wq_mutex); } static int autofs4_write(struct file *file, const void *addr, int bytes) @@ -333,17 +341,10 @@ int autofs4_wait(struct autofs_sb_info * wq->name.name, notify); } - /* wq->name is NULL if and only if the lock is already released */ - - if (sbi->catatonic) { - /* We might have slept, so check again for catatonic mode */ - wq->status = -ENOENT; - if (wq->name.name) { - kfree(wq->name.name); - wq->name.name = NULL; - } - } - + /* + * wq->name.name is NULL iff the lock is already released + * or the mount has been made catatonic. + */ if (wq->name.name) { /* Block all but "shutdown" signals while waiting */ sigset_t oldset; _ Patches currently in -mm which might be from raven@xxxxxxxxxx are autofs4-dont-make-expiring-dentry-negative.patch autofs4-dont-make-expiring-dentry-negative-fix.patch autofs4-revert-redo-lookup-in-ttfd.patch autofs4-use-look-aside-list-for-lookups.patch autofs4-use-look-aside-list-for-lookups-autofs4-fix-symlink-name-allocation.patch autofs4-dont-release-directory-mutex-if-called-in-oz_mode.patch autofs4-use-lookup-intent-flags-to-trigger-mounts.patch autofs4-use-struct-qstr-in-waitqc.patch autofs4-fix-waitq-locking.patch autofs4-fix-pending-mount-race.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html