nilfs2: use refcount_dec_and_lock() to fix potential UAF

[linux-2.6-microblaze.git] / fs / nilfs2 / the_nilfs.c

diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
index 8b7b01a..c8bfc01 100644 (file)
--- a/fs/nilfs2/the_nilfs.c
+++ b/fs/nilfs2/the_nilfs.c
@@ -792,14 +792,13 @@ nilfs_find_or_create_root(struct the_nilfs *nilfs, __u64 cno)
 
 void nilfs_put_root(struct nilfs_root *root)
 {
-       if (refcount_dec_and_test(&root->count)) {
-               struct the_nilfs *nilfs = root->nilfs;
+       struct the_nilfs *nilfs = root->nilfs;
 
-               nilfs_sysfs_delete_snapshot_group(root);
-
-               spin_lock(&nilfs->ns_cptree_lock);
+       if (refcount_dec_and_lock(&root->count, &nilfs->ns_cptree_lock)) {
                rb_erase(&root->rb_node, &nilfs->ns_cptree);
                spin_unlock(&nilfs->ns_cptree_lock);
+
+               nilfs_sysfs_delete_snapshot_group(root);
                iput(root->ifile);
 
                kfree(root);