nagai/kernel
3
0
Fork 0
forked from mirrors/linux
Code Pull requests Activity

fix deadlock in pivot_root()

Browse source 
Don't hold vfsmount_lock over the loop traversing ->mnt_parent;
do check_mnt(new.mnt) under namespace_sem instead; combined with
namespace_sem held over all that code it'll guarantee the stability
of ->mnt_parent chain all the way to the root.

Doing check_mnt() outside of namespace_sem in case of pivot_root()
is wrong anyway.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
This commit is contained in:
Al Viro 2011-03-18 08:29:36 -04:00
parent 9d412a43c3
commit 27cb1572e3
1 changed files with 5 additions and 11 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

16
fs/namespace.c
View file

@ -2569,9 +2569,6 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
error = user_path_dir(new_root, &new); error = user_path_dir(new_root, &new);
if (error) if (error)
goto out0; goto out0;
error = -EINVAL;
if (!check_mnt(new.mnt))
goto out1;
error = user_path_dir(put_old, &old); error = user_path_dir(put_old, &old);
if (error) if (error)
@ -2591,7 +2588,7 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
IS_MNT_SHARED(new.mnt->mnt_parent) || IS_MNT_SHARED(new.mnt->mnt_parent) ||
IS_MNT_SHARED(root.mnt->mnt_parent)) IS_MNT_SHARED(root.mnt->mnt_parent))
goto out2; goto out2;
if (!check_mnt(root.mnt)) if (!check_mnt(root.mnt) || !check_mnt(new.mnt))
goto out2; goto out2;
error = -ENOENT; error = -ENOENT;
if (cant_mount(old.dentry)) if (cant_mount(old.dentry))
@ -2615,19 +2612,19 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
goto out2; /* not attached */ goto out2; /* not attached */
/* make sure we can reach put_old from new_root */ /* make sure we can reach put_old from new_root */
tmp = old.mnt; tmp = old.mnt;
br_write_lock(vfsmount_lock);
if (tmp != new.mnt) { if (tmp != new.mnt) {
for (;;) { for (;;) {
if (tmp->mnt_parent == tmp) if (tmp->mnt_parent == tmp)
goto out3; /* already mounted on put_old */ goto out2; /* already mounted on put_old */
if (tmp->mnt_parent == new.mnt) if (tmp->mnt_parent == new.mnt)
break; break;
tmp = tmp->mnt_parent; tmp = tmp->mnt_parent;
} }
if (!is_subdir(tmp->mnt_mountpoint, new.dentry)) if (!is_subdir(tmp->mnt_mountpoint, new.dentry))
goto out3; goto out2;
} else if (!is_subdir(old.dentry, new.dentry)) } else if (!is_subdir(old.dentry, new.dentry))
goto out3; goto out2;
br_write_lock(vfsmount_lock);
detach_mnt(new.mnt, &parent_path); detach_mnt(new.mnt, &parent_path);
detach_mnt(root.mnt, &root_parent); detach_mnt(root.mnt, &root_parent);
/* mount old root on put_old */ /* mount old root on put_old */
@ -2650,9 +2647,6 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
path_put(&new); path_put(&new);
out0: out0:
return error; return error;
out3:
br_write_unlock(vfsmount_lock);
goto out2;
} }
static void __init init_mount_tree(void) static void __init init_mount_tree(void)