Files
mirror_zfs/module/zfs
Chunwei Chen 061460dfe2 Fix get_zfs_sb race with concurrent umount
Certain ioctl operations will call get_zfs_sb, which will holds an active
count on sb without checking whether it's active or not. This will result
in use-after-free. We fix this by using atomic_inc_not_zero to make sure
we got an active sb.

P1                                          P2
---                                         ---
deactivate_locked_super(): s_active = 0
                                            zfs_sb_hold()
                                            ->get_zfs_sb(): s_active = 1
->zpl_kill_sb()
-->zpl_put_super()
--->zfs_umount()
---->zfs_sb_free(zsb)
                                            zfs_sb_rele(zsb)

Signed-off-by: Chunwei Chen <david.chen@osnexus.com>
Signed-off-by: Brian Behlendorf <behlendorf1@llnl.gov>
2016-07-12 13:34:14 -07:00
..
2014-08-01 14:28:05 -07:00
2015-01-16 14:41:26 -08:00
2016-01-08 15:08:19 -08:00
2016-01-08 20:23:23 -05:00
2016-06-24 13:13:21 -07:00
2015-01-16 14:41:26 -08:00
2016-01-08 15:08:19 -08:00
2016-06-28 13:47:02 -07:00
2016-06-24 13:13:21 -07:00
2016-06-24 13:13:21 -07:00
2016-06-24 13:13:21 -07:00
2016-06-28 13:47:02 -07:00
2013-12-18 16:46:35 -08:00
2015-01-16 14:41:26 -08:00
2015-01-16 14:41:26 -08:00
2015-12-22 10:21:33 -08:00
2016-04-21 09:49:25 -07:00
2016-06-21 09:58:37 -07:00
2015-01-16 14:41:26 -08:00
2016-06-24 13:13:21 -07:00
2010-08-31 13:41:59 -07:00
2010-08-31 13:41:58 -07:00
2016-05-02 14:27:45 -07:00
2016-06-24 13:13:21 -07:00
2016-01-08 15:08:19 -08:00
2015-01-16 14:41:26 -08:00
2016-01-13 13:55:12 -08:00
2015-01-16 14:41:26 -08:00
2013-10-31 14:58:04 -07:00
2016-06-24 13:13:21 -07:00
2016-06-24 13:13:21 -07:00
2016-06-24 13:13:21 -07:00
2010-08-31 13:41:58 -07:00
2015-09-04 16:08:14 -07:00
2016-04-05 18:54:55 -07:00
2016-06-21 09:58:37 -07:00
2016-06-24 13:13:21 -07:00
2016-05-17 10:29:02 -07:00
2016-06-24 13:13:21 -07:00
2016-06-24 13:13:21 -07:00
2014-08-01 14:28:05 -07:00
2016-05-31 16:04:26 -07:00
2016-06-28 13:47:02 -07:00