[PATCH] namei fixes (16/19)
Conditional mntput() moved into __do_follow_link(). There it collapses with unconditional mntget() on the same sucker, closing another too-early-mntput() race. Signed-off-by: Al Viro <viro@parcelfarce.linux.theplanet.co.uk> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
parent
d9d29a2966
commit
39ca6d4975
|
@ -506,7 +506,8 @@ static inline int __do_follow_link(struct path *path, struct nameidata *nd)
|
||||||
touch_atime(nd->mnt, dentry);
|
touch_atime(nd->mnt, dentry);
|
||||||
nd_set_link(nd, NULL);
|
nd_set_link(nd, NULL);
|
||||||
|
|
||||||
mntget(path->mnt);
|
if (path->mnt == nd->mnt)
|
||||||
|
mntget(path->mnt);
|
||||||
error = dentry->d_inode->i_op->follow_link(dentry, nd);
|
error = dentry->d_inode->i_op->follow_link(dentry, nd);
|
||||||
if (!error) {
|
if (!error) {
|
||||||
char *s = nd_get_link(nd);
|
char *s = nd_get_link(nd);
|
||||||
|
@ -543,8 +544,6 @@ static inline int do_follow_link(struct path *path, struct nameidata *nd)
|
||||||
current->link_count++;
|
current->link_count++;
|
||||||
current->total_link_count++;
|
current->total_link_count++;
|
||||||
nd->depth++;
|
nd->depth++;
|
||||||
if (path->mnt != nd->mnt)
|
|
||||||
mntput(path->mnt);
|
|
||||||
err = __do_follow_link(path, nd);
|
err = __do_follow_link(path, nd);
|
||||||
current->link_count--;
|
current->link_count--;
|
||||||
nd->depth--;
|
nd->depth--;
|
||||||
|
@ -1550,8 +1549,6 @@ do_link:
|
||||||
error = security_inode_follow_link(path.dentry, nd);
|
error = security_inode_follow_link(path.dentry, nd);
|
||||||
if (error)
|
if (error)
|
||||||
goto exit_dput;
|
goto exit_dput;
|
||||||
if (nd->mnt != path.mnt)
|
|
||||||
mntput(path.mnt);
|
|
||||||
error = __do_follow_link(&path, nd);
|
error = __do_follow_link(&path, nd);
|
||||||
if (error)
|
if (error)
|
||||||
return error;
|
return error;
|
||||||
|
|
Loading…
Reference in New Issue