164f98adbb
The sm_count is decremented to zero but left on the nsm_handles list. So in the space between decrementing sm_count and acquiring nsm_mutex, it is possible for another task to find this nsm_handle, increment the use count and then enter nsm_release itself. Thus there's nothing to prevent the nsm being freed before we acquire nsm_mutex here. Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu> |
||
|---|---|---|
| .. | ||
| clntlock.c | ||
| clntproc.c | ||
| host.c | ||
| Makefile | ||
| mon.c | ||
| svc4proc.c | ||
| svc.c | ||
| svclock.c | ||
| svcproc.c | ||
| svcshare.c | ||
| svcsubs.c | ||
| xdr4.c | ||
| xdr.c | ||