FROMLIST: namespace: update event counter when umounting a deleted dentry

- m_start() in fs/namespace.c expects that ns->event is incremented each
  time a mount added or removed from ns->list.
- umount_tree() removes items from the list but does not increment event
  counter, expecting that it's done before the function is called.
- There are some codepaths that call umount_tree() without updating
  "event" counter. e.g. from __detach_mounts().
- When this happens m_start may reuse a cached mount structure that no
  longer belongs to ns->list (i.e. use after free which usually leads
  to infinite loop).

This change fixes the above problem by incrementing global event counter
before invoking umount_tree().


Signed-off-by: Andrey Ulanov <>

TEST=see the test code attached to the bug

Commit-Ready: Andrey Ulanov <>
Tested-by: Andrey Ulanov <>
Reviewed-by: Sonny Rao <>
(cherry picked from commit 477e9264248e35924b8e396d30f49b0473f2fa04)

Change-Id: Ie09b8d7bc0ebb4cf24e050ccced33d3362e07ab8
Reviewed-by: Sonny Rao <>
Tested-by: Andrey Ulanov <>
Commit-Queue: Andrey Ulanov <>
1 file changed