Commit e06b933e authored by Andrey Ulanov's avatar Andrey Ulanov Committed by Al Viro

namespace: update event counter when umounting a deleted dentry

- m_start() in fs/namespace.c expects that ns->event is incremented each
  time a mount added or removed from ns->list.
- umount_tree() removes items from the list but does not increment event
  counter, expecting that it's done before the function is called.
- There are some codepaths that call umount_tree() without updating
  "event" counter. e.g. from __detach_mounts().
- When this happens m_start may reuse a cached mount structure that no
  longer belongs to ns->list (i.e. use after free which usually leads
  to infinite loop).

This change fixes the above problem by incrementing global event counter
before invoking umount_tree().

Change-Id: I622c8e84dcb9fb63542372c5dbf0178ee86bb589
Cc: stable@vger.kernel.org
Signed-off-by: default avatarAndrey Ulanov <andreyu@google.com>
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent b403f0e3
...@@ -1562,6 +1562,7 @@ void __detach_mounts(struct dentry *dentry) ...@@ -1562,6 +1562,7 @@ void __detach_mounts(struct dentry *dentry)
goto out_unlock; goto out_unlock;
lock_mount_hash(); lock_mount_hash();
event++;
while (!hlist_empty(&mp->m_list)) { while (!hlist_empty(&mp->m_list)) {
mnt = hlist_entry(mp->m_list.first, struct mount, mnt_mp_list); mnt = hlist_entry(mp->m_list.first, struct mount, mnt_mp_list);
if (mnt->mnt.mnt_flags & MNT_UMOUNT) { if (mnt->mnt.mnt_flags & MNT_UMOUNT) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment