FROMLIST: namespace: update event counter when umounting a deleted dentry
- m_start() in fs/namespace.c expects that ns->event is incremented each
time a mount added or removed from ns->list.
- umount_tree() removes items from the list but does not increment event
counter, expecting that it's done before the function is called.
- There are some codepaths that call umount_tree() without updating
"event" counter. e.g. from __detach_mounts().
- When this happens m_start may reuse a cached mount structure that no
longer belongs to ns->list (i.e. use after free which usually leads
to infinite loop).
This change fixes the above problem by incrementing global event counter
before invoking umount_tree().
(from https://patchwork.kernel.org/patch/8859301/)
Signed-off-by: Andrey Ulanov <andreyu@google.com>
BUG=chromium:605197
TEST=see the test code attached to the bug
Reviewed-on: https://chromium-review.googlesource.com/338966
Commit-Ready: Andrey Ulanov <andreyu@google.com>
Tested-by: Andrey Ulanov <andreyu@google.com>
Reviewed-by: Sonny Rao <sonnyrao@chromium.org>
(cherry picked from commit 477e9264248e35924b8e396d30f49b0473f2fa04)
Change-Id: Ie09b8d7bc0ebb4cf24e050ccced33d3362e07ab8
Reviewed-on: https://chromium-review.googlesource.com/340185
Reviewed-by: Sonny Rao <sonnyrao@chromium.org>
Tested-by: Andrey Ulanov <andreyu@google.com>
Commit-Queue: Andrey Ulanov <andreyu@google.com>
1 file changed