diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2010-10-29 03:30:42 -0400 |
|---|---|---|
| committer | Al Viro <viro@zeniv.linux.org.uk> | 2010-10-29 04:14:56 -0400 |
| commit | d893f1bc2a9f0f7dcb4b433452c59f9bedac0d7d (patch) | |
| tree | b3cf84a271ccb19529d83a544b6024bbb23a7801 /mm/mincore.c | |
| parent | a4118ee1d80b527c385cadd14db79559efb8a493 (diff) | |
| download | op-kernel-dev-d893f1bc2a9f0f7dcb4b433452c59f9bedac0d7d.zip op-kernel-dev-d893f1bc2a9f0f7dcb4b433452c59f9bedac0d7d.tar.gz | |
fix open/umount race
nameidata_to_filp() drops nd->path or transfers it to opened
file. In the former case it's a Bad Idea(tm) to do mnt_drop_write()
on nd->path.mnt, since we might race with umount and vfsmount in
question might be gone already.
Fix: don't drop it, then... IOW, have nameidata_to_filp() grab nd->path
in case it transfers it to file and do path_drop() in callers. After
they are through with accessing nd->path...
Reported-by: Miklos Szeredi <miklos@szeredi.hu>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'mm/mincore.c')
0 files changed, 0 insertions, 0 deletions
