posix_acl: de-union a_refcount and a_rcu

Currently the two are unioned together, but I don't think that's safe.

It looks like get_cached_acl could race with the last put in
posix_acl_release. get_cached_acl calls atomic_inc_not_zero on
a_refcount, but that field could have already been clobbered by
call_rcu, and may no longer be zero. Fix this by de-unioning the two
fields.

Fixes: b8a7a3a667 (posix_acl: Inode acl caching fixes)
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
This commit is contained in:
Jeff Layton 2016-07-11 09:10:06 -04:00 committed by Al Viro
parent c94c09535c
commit 6d4e56ce97

View file

@ -43,10 +43,8 @@ struct posix_acl_entry {
};
struct posix_acl {
union {
atomic_t a_refcount;
struct rcu_head a_rcu;
};
unsigned int a_count;
struct posix_acl_entry a_entries[0];
};