From: Andrey Borzenkov <arvidjaar@mail.ru>

devfs_mk_dir freed wrong de and incorrectly passed to devfsd already freed
de.  Besides it did not even check if entry found was actually directory.


 fs/devfs/base.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff -puN fs/devfs/base.c~devfs_mk_dir fs/devfs/base.c
--- 25/fs/devfs/base.c~devfs_mk_dir	2003-08-10 02:30:49.000000000 -0700
+++ 25-akpm/fs/devfs/base.c	2003-08-10 02:30:49.000000000 -0700
@@ -1697,13 +1697,13 @@ int devfs_mk_dir(const char *fmt, ...)
 	}
 
 	error = _devfs_append_entry(dir, de, &old);
-	if (error == -EEXIST) {
+	if (error == -EEXIST && S_ISDIR(old->mode)) {
 		/*
 		 * devfs_mk_dir() of an already-existing directory will
 		 * return success.
 		 */
 		error = 0;
-		devfs_put(old);
+		goto out_put;
 	} else if (error) {
 		PRINTK("(%s): could not append to dir: %p \"%s\"\n",
 				buf, dir, dir->name);

_