autofs_d_release() can overlap with lockless ->d_manage(), ending up with autofs_dentry_ino() freed under the latter. Make freeing autofs_info instances RCU-delayed...
Unified · Split
| @@ -71,6 +71,7 @@ struct autofs_info { · 70 unmodified lines | ||
| 71 | 71 | |
| 72 | 72 | kuid_t uid; |
| 73 | 73 | kgid_t gid; |
| 74 | + struct rcu_head rcu; | |
| 74 | 75 | }; |
| 75 | 76 | |
| 76 | 77 | #define AUTOFS_INF_EXPIRING (1<<0) /* dentry in the process of expiring */ |
| @@ -36,7 +36,7 @@ void autofs_clean_ino(struct autofs_info *ino) · 35 unmodified lines | ||
| 36 | 36 | |
| 37 | 37 | void autofs_free_ino(struct autofs_info *ino) |
| 38 | 38 | { |
| 39 | − kfree(ino); | |
| 39 | + kfree_rcu(ino, rcu); | |
| 40 | 40 | } |
| 41 | 41 | |
| 42 | 42 | void autofs_kill_sb(struct super_block *sb) |