tree 4ef6a78804e4b6f055875608f0f5402fe42e3275
parent b53a9658a35bf524a10f057ab919d060ca41a1bf
author Andrey Ulanov <andreyu@google.com> 1460660869 -0700
committer ChromeOS bot <3su6n15k.default@developer.gserviceaccount.com> 1461267520 +0000

FROMLIST: namespace: update event counter when umounting a deleted dentry

- m_start() in fs/namespace.c expects that ns->event is incremented each
  time a mount added or removed from ns->list.
- umount_tree() removes items from the list but does not increment event
  counter, expecting that it's done before the function is called.
- There are some codepaths that call umount_tree() without updating
  "event" counter. e.g. from __detach_mounts().
- When this happens m_start may reuse a cached mount structure that no
  longer belongs to ns->list (i.e. use after free which usually leads
  to infinite loop).

This change fixes the above problem by incrementing global event counter
before invoking umount_tree().

(from https://patchwork.kernel.org/patch/8859301/)

Signed-off-by: Andrey Ulanov <andreyu@google.com>

BUG=chromium:605197
TEST=see the test code attached to the bug

Reviewed-on: https://chromium-review.googlesource.com/338966
Commit-Ready: Andrey Ulanov <andreyu@google.com>
Tested-by: Andrey Ulanov <andreyu@google.com>
Reviewed-by: Sonny Rao <sonnyrao@chromium.org>
(cherry picked from commit 477e9264248e35924b8e396d30f49b0473f2fa04)

Change-Id: Ie09b8d7bc0ebb4cf24e050ccced33d3362e07ab8
Reviewed-on: https://chromium-review.googlesource.com/340185
Reviewed-by: Sonny Rao <sonnyrao@chromium.org>
Tested-by: Andrey Ulanov <andreyu@google.com>
Commit-Queue: Andrey Ulanov <andreyu@google.com>