FROMLIST: namespace: update event counter when umounting a deleted dentry
- m_start() in fs/namespace.c expects that ns->event is incremented each
time a mount added or removed from ns->list.
- umount_tree() removes items from the list but does not increment event
counter, expecting that it's done before the function is called.
- There are some codepaths that call umount_tree() without updating
"event" counter. e.g. from __detach_mounts().
- When this happens m_start may reuse a cached mount structure that no
longer belongs to ns->list (i.e. use after free which usually leads
to infinite loop).
This change fixes the above problem by incrementing global event counter
before invoking umount_tree().
(from https://patchwork.kernel.org/patch/8859301/)
Signed-off-by: Andrey Ulanov <andreyu@google.com>
BUG=chromium:605197
TEST=see the test code attached to the bug
Reviewed-on: https://chromium-review.googlesource.com/338966
Commit-Ready: Andrey Ulanov <andreyu@google.com>
Tested-by: Andrey Ulanov <andreyu@google.com>
Reviewed-by: Sonny Rao <sonnyrao@chromium.org>
(cherry picked from commit 477e9264248e35924b8e396d30f49b0473f2fa04)
Change-Id: Ie09b8d7bc0ebb4cf24e050ccced33d3362e07ab8
Reviewed-on: https://chromium-review.googlesource.com/340185
Reviewed-by: Sonny Rao <sonnyrao@chromium.org>
Tested-by: Andrey Ulanov <andreyu@google.com>
Commit-Queue: Andrey Ulanov <andreyu@google.com>
diff --git a/fs/namespace.c b/fs/namespace.c
index 5ca9b1b..34bcda0 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1496,6 +1496,7 @@
goto out_unlock;
lock_mount_hash();
+ event++;
while (!hlist_empty(&mp->m_list)) {
mnt = hlist_entry(mp->m_list.first, struct mount, mnt_mp_list);
umount_tree(mnt, 2);
@@ -1506,7 +1507,7 @@
namespace_unlock();
}
-/*
+/*
* Is the caller allowed to modify his namespace?
*/
static inline bool may_mount(void)
