iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[PATCH] namespace.c: fix mnt_namespace clearing

Browse Source 
This patch clears mnt_namespace on unmount.

Not clearing mnt_namespace has two effects:

   1) It is possible to attach a new mount to a detached mount,
      because check_mnt() returns true.

      This means, that when no other references to the detached mount
      remain, it still can't be freed.  This causes a resource leak,
      and possibly un-removable modules.

   2) If mnt_namespace is dereferenced (only in mark_mounts_for_expiry())
      after the namspace has been freed, it can cause an Oops, memory
      corruption, etc.

1) has been tested before and after the patch, 2) is only speculation.

Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
Acked-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
Miklos Szeredi 2005-07-07 17:57:22 -07:00 committed by Linus Torvalds
parent 6f50142e4b
commit 202322e6f7
1 changed files with 1 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
fs/namespace.c
View File

@ -345,6 +345,7 @@ static void umount_tree(struct vfsmount *mnt)
for (p = mnt; p; p = next_mnt(p, mnt)) { for (p = mnt; p; p = next_mnt(p, mnt)) {
list_del(&p->mnt_list); list_del(&p->mnt_list);
list_add(&p->mnt_list, &kill); list_add(&p->mnt_list, &kill);
p->mnt_namespace = NULL;
} }
while (!list_empty(&kill)) { while (!list_empty(&kill)) {
@ -1449,15 +1450,8 @@ void __init mnt_init(unsigned long mempages)
void __put_namespace(struct namespace *namespace) void __put_namespace(struct namespace *namespace)
{ {
struct vfsmount *mnt;
down_write(&namespace->sem); down_write(&namespace->sem);
spin_lock(&vfsmount_lock); spin_lock(&vfsmount_lock);
list_for_each_entry(mnt, &namespace->list, mnt_list) {
mnt->mnt_namespace = NULL;
}
umount_tree(namespace->root); umount_tree(namespace->root);
spin_unlock(&vfsmount_lock); spin_unlock(&vfsmount_lock);
up_write(&namespace->sem); up_write(&namespace->sem);