Commit 541f40bd authored by Andrew Morton's avatar Andrew Morton Committed by Linus Torvalds

[PATCH] proc_check_root() locking fix

From: Maneesh Soni <maneesh@in.ibm.com>

The patch fixes locking in proc_check_root().  It brings is_subdir() call
under vfsmount_lock.  Holding vfsmount_lock will ensure mnt_mountpoint
dentry is intact and the dentry does not go away while it is being checked
in is_subdir().
parent b5a660ee
...@@ -425,17 +425,15 @@ static int proc_check_root(struct inode *inode) ...@@ -425,17 +425,15 @@ static int proc_check_root(struct inode *inode)
mnt = vfsmnt; mnt = vfsmnt;
while (vfsmnt != our_vfsmnt) { while (vfsmnt != our_vfsmnt) {
if (vfsmnt == vfsmnt->mnt_parent) { if (vfsmnt == vfsmnt->mnt_parent)
spin_unlock(&vfsmount_lock);
goto out; goto out;
}
de = vfsmnt->mnt_mountpoint; de = vfsmnt->mnt_mountpoint;
vfsmnt = vfsmnt->mnt_parent; vfsmnt = vfsmnt->mnt_parent;
} }
spin_unlock(&vfsmount_lock);
if (!is_subdir(de, base)) if (!is_subdir(de, base))
goto out; goto out;
spin_unlock(&vfsmount_lock);
exit: exit:
dput(base); dput(base);
...@@ -444,6 +442,7 @@ static int proc_check_root(struct inode *inode) ...@@ -444,6 +442,7 @@ static int proc_check_root(struct inode *inode)
mntput(mnt); mntput(mnt);
return res; return res;
out: out:
spin_unlock(&vfsmount_lock);
res = -EACCES; res = -EACCES;
goto exit; goto exit;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment