summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMiklos Szeredi <miklos@szeredi.hu>2005-07-07 17:57:22 -0700
committerLinus Torvalds <torvalds@g5.osdl.org>2005-07-07 18:23:51 -0700
commit202322e6f7cd12e82b5ff0fa92bbdf517fcf0947 (patch)
tree82c1f7b4b97d5b31654157a8f427a5c8d546504f
parent6f50142e4b092a469920a0008fc23121c3d99f2f (diff)
[PATCH] namespace.c: fix mnt_namespace clearing
This patch clears mnt_namespace on unmount. Not clearing mnt_namespace has two effects: 1) It is possible to attach a new mount to a detached mount, because check_mnt() returns true. This means, that when no other references to the detached mount remain, it still can't be freed. This causes a resource leak, and possibly un-removable modules. 2) If mnt_namespace is dereferenced (only in mark_mounts_for_expiry()) after the namspace has been freed, it can cause an Oops, memory corruption, etc. 1) has been tested before and after the patch, 2) is only speculation. Signed-off-by: Miklos Szeredi <miklos@szeredi.hu> Acked-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
-rw-r--r--fs/namespace.c8
1 files changed, 1 insertions, 7 deletions
diff --git a/fs/namespace.c b/fs/namespace.c
index 208c079e9fd..a0d0ef1f1a4 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -345,6 +345,7 @@ static void umount_tree(struct vfsmount *mnt)
for (p = mnt; p; p = next_mnt(p, mnt)) {
list_del(&p->mnt_list);
list_add(&p->mnt_list, &kill);
+ p->mnt_namespace = NULL;
}
while (!list_empty(&kill)) {
@@ -1449,15 +1450,8 @@ void __init mnt_init(unsigned long mempages)
void __put_namespace(struct namespace *namespace)
{
- struct vfsmount *mnt;
-
down_write(&namespace->sem);
spin_lock(&vfsmount_lock);
-
- list_for_each_entry(mnt, &namespace->list, mnt_list) {
- mnt->mnt_namespace = NULL;
- }
-
umount_tree(namespace->root);
spin_unlock(&vfsmount_lock);
up_write(&namespace->sem);