FROMLIST: namespace: update event counter when umounting a deleted dentry

- m_start() in fs/namespace.c expects that ns->event is incremented each
  time a mount added or removed from ns->list.
- umount_tree() removes items from the list but does not increment event
  counter, expecting that it's done before the function is called.
- There are some codepaths that call umount_tree() without updating
  "event" counter. e.g. from __detach_mounts().
- When this happens m_start may reuse a cached mount structure that no
  longer belongs to ns->list (i.e. use after free which usually leads
  to infinite loop).

This change fixes the above problem by incrementing global event counter
before invoking umount_tree().

(from https://patchwork.kernel.org/patch/8859301/)

Signed-off-by: Andrey Ulanov <andreyu@google.com>

BUG=chromium:605197
TEST=see the test code attached to the bug

Reviewed-on: https://chromium-review.googlesource.com/338966
Commit-Ready: Andrey Ulanov <andreyu@google.com>
Tested-by: Andrey Ulanov <andreyu@google.com>
Reviewed-by: Sonny Rao <sonnyrao@chromium.org>
(cherry picked from commit 477e9264248e35924b8e396d30f49b0473f2fa04)

Change-Id: Ie09b8d7bc0ebb4cf24e050ccced33d3362e07ab8
Reviewed-on: https://chromium-review.googlesource.com/340185
Reviewed-by: Sonny Rao <sonnyrao@chromium.org>
Tested-by: Andrey Ulanov <andreyu@google.com>
Commit-Queue: Andrey Ulanov <andreyu@google.com>
1 file changed