lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[CIFS] Fix oops on failed cifs mount (in kthread_stop)

Browse Source 
If the cifs demultiplex thread wakes up and exits
(zeroing server->tsk) before kthread_stop is called, the
cifs_mount code could pass a null pointer to kthread_stop

Thanks to akpm, Dave Young and Shaggy for suggesting
earlier versions of this patch.

CC: akpm@linux-foundatior.org
Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
Signed-off-by: Dave Kleikamp <shaggy@linux.vnet.ibm.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
This commit is contained in:
Steve French
2007-05-23 14:45:36 +00:00
parent ad9ddd66c6
commit 28356a1679
1 changed files with 12 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
fs/cifs/connect.c
View File

@@ -2069,8 +2069,15 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
srvTcp->tcpStatus = CifsExiting; srvTcp->tcpStatus = CifsExiting;
spin_unlock(&GlobalMid_Lock); spin_unlock(&GlobalMid_Lock);
if (srvTcp->tsk) { if (srvTcp->tsk) {
struct task_struct *tsk;
/* If we could verify that kthread_stop would
always wake up processes blocked in
tcp in recv_mesg then we could remove the
send_sig call */
send_sig(SIGKILL,srvTcp->tsk,1); send_sig(SIGKILL,srvTcp->tsk,1);
kthread_stop(srvTcp->tsk); tsk = srvTcp->tsk;
if(tsk)
kthread_stop(srvTcp->tsk);
} }
} }
/* If find_unc succeeded then rc == 0 so we can not end */ /* If find_unc succeeded then rc == 0 so we can not end */
@@ -2085,8 +2092,11 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
/* if the socketUseCount is now zero */ /* if the socketUseCount is now zero */
if ((temp_rc == -ESHUTDOWN) && if ((temp_rc == -ESHUTDOWN) &&
(pSesInfo->server) && (pSesInfo->server->tsk)) { (pSesInfo->server) && (pSesInfo->server->tsk)) {
struct task_struct *tsk;
send_sig(SIGKILL,pSesInfo->server->tsk,1); send_sig(SIGKILL,pSesInfo->server->tsk,1);
kthread_stop(pSesInfo->server->tsk); tsk = pSesInfo->server->tsk;
if(tsk)
kthread_stop(tsk);
} }
} else } else
cFYI(1, ("No session or bad tcon")); cFYI(1, ("No session or bad tcon"));