diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2008-02-23 06:46:49 -0500 |
|---|---|---|
| committer | Al Viro <viro@zeniv.linux.org.uk> | 2008-05-01 13:08:50 -0400 |
| commit | 2030a42cecd4dd1985a2ab03e25f3cd6106a5ca8 (patch) | |
| tree | 7cb4710c3f7a4e034a20890f0df99bc42f9bbcee /fs/timerfd.c | |
| parent | 9f3acc3140444a900ab280de942291959f0f615d (diff) | |
| download | linux-3.10-2030a42cecd4dd1985a2ab03e25f3cd6106a5ca8.tar.gz linux-3.10-2030a42cecd4dd1985a2ab03e25f3cd6106a5ca8.tar.bz2 linux-3.10-2030a42cecd4dd1985a2ab03e25f3cd6106a5ca8.zip | |
[PATCH] sanitize anon_inode_getfd()
a) none of the callers even looks at inode or file returned by anon_inode_getfd()
b) any caller that would try to look at those would be racy, since by the time
it returns we might have raced with close() from another thread and that
file would be pining for fjords.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'fs/timerfd.c')
| -rw-r--r-- | fs/timerfd.c | 11 |
1 files changed, 3 insertions, 8 deletions
diff --git a/fs/timerfd.c b/fs/timerfd.c index 5400524e9cb..d87d354ec42 100644 --- a/fs/timerfd.c +++ b/fs/timerfd.c @@ -181,10 +181,8 @@ static struct file *timerfd_fget(int fd) asmlinkage long sys_timerfd_create(int clockid, int flags) { - int error, ufd; + int ufd; struct timerfd_ctx *ctx; - struct file *file; - struct inode *inode; if (flags) return -EINVAL; @@ -200,12 +198,9 @@ asmlinkage long sys_timerfd_create(int clockid, int flags) ctx->clockid = clockid; hrtimer_init(&ctx->tmr, clockid, HRTIMER_MODE_ABS); - error = anon_inode_getfd(&ufd, &inode, &file, "[timerfd]", - &timerfd_fops, ctx); - if (error) { + ufd = anon_inode_getfd("[timerfd]", &timerfd_fops, ctx); + if (ufd < 0) kfree(ctx); - return error; - } return ufd; } |