A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-28 10:41:38 -04:00
Code Issues Projects Releases Packages Wiki Activity

fix open/umount race

Browse source 
nameidata_to_filp() drops nd->path or transfers it to opened
file.  In the former case it's a Bad Idea(tm) to do mnt_drop_write()
on nd->path.mnt, since we might race with umount and vfsmount in
question might be gone already.

Fix: don't drop it, then...  IOW, have nameidata_to_filp() grab nd->path
in case it transfers it to file and do path_drop() in callers.  After
they are through with accessing nd->path...

Reported-by: Miklos Szeredi <[email protected]>
Signed-off-by: Al Viro <[email protected]>
This commit is contained in:
Al Viro 2010-10-29 03:30:42 -04:00
commit d893f1bc2a
2 changed files with 5 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
fs/namei.c
View file

@ -1574,6 +1574,7 @@ static struct file *finish_open(struct nameidata *nd,
*/
if (will_truncate)
mnt_drop_write(nd->path.mnt);
path_put(&nd->path);
return filp;
exit:
@ -1675,6 +1676,7 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
}
filp = nameidata_to_filp(nd);
mnt_drop_write(nd->path.mnt);
path_put(&nd->path);
if (!IS_ERR(filp)) {
error = ima_file_check(filp, acc_mode);
if (error) {