From: Trond Myklebust Date: Thu, 3 Dec 2009 13:10:17 +0000 (-0500) Subject: RPC: Fix two potential races in put_rpccred X-Git-Tag: v2.6.33-rc1~287^2^2~44^2~9 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f0380f3d16df8f9e2fcd1d8c16fb0d94370bea99;p=pandora-kernel.git RPC: Fix two potential races in put_rpccred It is possible for rpcauth_destroy_credcache() to cause the rpc credentials to be unhashed while put_rpccred is waiting for the rpc_credcache_lock on another cpu. Should this happen, then we can end up calling hlist_del_rcu(&cred->cr_hash) a second time in put_rpccred, thus causing list corruption. Should the credential actually be hashed, it is also possible for rpcauth_lookup_credcache to find and reference it before we get round to unhashing it. In this case, the call to rpcauth_unhash_cred will fail, and so we should just exit without destroying the cred. Reported-by: Neil Brown Signed-off-by: Trond Myklebust --- Reading git-diff-tree failed