Skip to main content

Browse the archive

https://github.com/torvalds/linux
05 April 2024, 19:05:47 UTC
Revision e06b933e6ded42384164d28a2060b7f89243b895 authored by Andrey Ulanov on 15 April 2016, 21:24:41 UTC, committed by Al Viro on 01 July 2016, 03:28:30 UTC 
namespace: update event counter when umounting a deleted dentry
 
- m_start() in fs/namespace.c expects that ns->event is incremented each
  time a mount added or removed from ns->list.
- umount_tree() removes items from the list but does not increment event
  counter, expecting that it's done before the function is called.
- There are some codepaths that call umount_tree() without updating
  "event" counter. e.g. from __detach_mounts().
- When this happens m_start may reuse a cached mount structure that no
  longer belongs to ns->list (i.e. use after free which usually leads
  to infinite loop).

This change fixes the above problem by incrementing global event counter
before invoking umount_tree().

Change-Id: I622c8e84dcb9fb63542372c5dbf0178ee86bb589
Cc: stable@vger.kernel.org
Signed-off-by: Andrey Ulanov <andreyu@google.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
1 parent b403f0e
History
Tip revision: e06b933e6ded42384164d28a2060b7f89243b895 authored by Andrey Ulanov on 15 April 2016, 21:24:41 UTC
namespace: update event counter when umounting a deleted dentry
Tip revision: e06b933
File Mode Size
Documentation
arch
block
certs
crypto
drivers
firmware
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.get_maintainer.ignore -rw-r--r-- 31 bytes
.gitignore -rw-r--r-- 1.2 KB
.mailmap -rw-r--r-- 5.8 KB
COPYING -rw-r--r-- 18.3 KB
CREDITS -rw-r--r-- 95.5 KB
Kbuild -rw-r--r-- 2.8 KB
Kconfig -rw-r--r-- 252 bytes
MAINTAINERS -rw-r--r-- 352.6 KB
Makefile -rw-r--r-- 56.0 KB
README -rw-r--r-- 18.1 KB
REPORTING-BUGS -rw-r--r-- 7.3 KB

README

back to top