iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[PATCH] namei fixes (16/19)

Browse Source 
Conditional mntput() moved into __do_follow_link().  There it collapses with
unconditional mntget() on the same sucker, closing another too-early-mntput()
race.

Signed-off-by: Al Viro <viro@parcelfarce.linux.theplanet.co.uk>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
Al Viro 2005-06-06 13:36:12 -07:00 committed by Linus Torvalds
parent d9d29a2966
commit 39ca6d4975
1 changed files with 2 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
fs/namei.c
View File

@ -506,7 +506,8 @@ static inline int __do_follow_link(struct path *path, struct nameidata *nd)
touch_atime(nd->mnt, dentry);
nd_set_link(nd, NULL);
mntget(path->mnt);
if (path->mnt == nd->mnt)
mntget(path->mnt);
error = dentry->d_inode->i_op->follow_link(dentry, nd);
if (!error) {
char *s = nd_get_link(nd);
@ -543,8 +544,6 @@ static inline int do_follow_link(struct path *path, struct nameidata *nd)
current->link_count++;
current->total_link_count++;
nd->depth++;
if (path->mnt != nd->mnt)
mntput(path->mnt);
err = __do_follow_link(path, nd);
current->link_count--;
nd->depth--;
@ -1550,8 +1549,6 @@ do_link:
error = security_inode_follow_link(path.dentry, nd);
if (error)
goto exit_dput;
if (nd->mnt != path.mnt)
mntput(path.mnt);
error = __do_follow_link(&path, nd);
if (error)
return error;