linux/include
Miklos Szeredi 1ce88cf466 [PATCH] namespace.c: fix race in mark_mounts_for_expiry()
This patch fixes a race found by Ram in mark_mounts_for_expiry() in
fs/namespace.c.

The bug can only be triggered with simultaneous exiting of a process having
a private namespace, and expiry of a mount from within that namespace.
It's practically impossible to trigger, and I haven't even tried.  But
still, a bug is a bug.

The race happens when put_namespace() is called by another task, while
mark_mounts_for_expiry() is between atomic_read() and get_namespace().  In
that case get_namespace() will be called on an already dead namespace with
unforeseeable results.

The solution was suggested by Al Viro, with his own words:

      Instead of screwing with atomic_read() in there, why don't we
      simply do the following:
      	a) atomic_dec_and_lock() in put_namespace()
      	b) __put_namespace() called without dropping lock
      	c) the first thing done by __put_namespace would be
      struct vfsmount *root = namespace->root;
      namespace->root = NULL;
      spin_unlock(...);
      ....
      umount_tree(root);
      ...
      	d) check in mark_... would be simply namespace && namespace->root.

      And we are all set; no screwing around with atomic_read(), no magic
      at all.  Dying namespace gets NULL ->root.
      All changes of ->root happen under spinlock.
      If under a spinlock we see non-NULL ->mnt_namespace, it won't be
      freed until we drop the lock (we will set ->mnt_namespace to NULL
      under that lock before we get to freeing namespace).
      If under a spinlock we see non-NULL ->mnt_namespace and
      ->mnt_namespace->root, we can grab a reference to namespace and be
      sure that it won't go away.

Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
Acked-by: Al Viro <viro@parcelfarce.linux.theplanet.co.uk>
Acked-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-07-07 18:23:51 -07:00
..
acpi [PATCH] acpi bridge hotadd: Export the interface to get PCI id for an ACPI handle 2005-06-27 21:52:42 -07:00
asm-alpha [PATCH] alpha(): pgprot_noncached 2005-07-07 18:23:47 -07:00
asm-arm [PATCH] ARM: 2792/1: IXP4xx iomap API implementation 2005-07-06 23:06:05 +01:00
asm-arm26 [PATCH] Serial: Split 8250 port table (part 2) 2005-06-29 18:45:19 +01:00
asm-cris [PATCH] streamline preempt_count type across archs 2005-06-23 09:45:19 -07:00
asm-frv [PATCH] PCI: fix up errors after dma bursting patch and CONFIG_PCI=n 2005-06-27 21:52:46 -07:00
asm-generic [PATCH] kexec: vmlinux: fix physical addresses 2005-06-25 16:24:47 -07:00
asm-h8300 [PATCH] streamline preempt_count type across archs 2005-06-23 09:45:19 -07:00
asm-i386 [PATCH] Fix up non-NUMA breakage in mmzone.h 2005-07-07 18:23:42 -07:00
asm-ia64 [IA64] fix generic/up builds 2005-07-06 18:18:10 -07:00
asm-m32r [PATCH] streamline preempt_count type across archs 2005-06-23 09:45:19 -07:00
asm-m68k [PATCH] Serial: Split 8250 port table (part 2) 2005-06-29 18:45:19 +01:00
asm-m68knommu [PATCH] streamline preempt_count type across archs 2005-06-23 09:45:19 -07:00
asm-mips [PATCH] Serial: Split 8250 port table (part 2) 2005-06-29 18:45:19 +01:00
asm-parisc [PATCH] Serial: Split 8250 port table (part 2) 2005-06-29 18:45:19 +01:00
asm-ppc [PATCH] ppc64: remove duplicate syscall reservation 2005-07-07 18:23:37 -07:00
asm-ppc64 [PATCH] ppc64: Make idle_loop a ppc_md function 2005-07-07 18:23:40 -07:00
asm-s390 [PATCH] s390: fix finish_arch_switch 2005-06-30 08:45:08 -07:00
asm-sh [PATCH] Serial: Split 8250 port table (part 2) 2005-06-29 18:45:19 +01:00
asm-sh64 [PATCH] Serial: Split 8250 port table (part 2) 2005-06-29 18:45:19 +01:00
asm-sparc [PATCH] PCI: fix up errors after dma bursting patch and CONFIG_PCI=n 2005-06-27 21:52:46 -07:00
asm-sparc64 [SPARC64]: Fix enable_dma() in asm-sparc64/parport.h 2005-07-06 15:41:54 -07:00
asm-um [PATCH] uml: skas0 - separate kernel address space on stock hosts 2005-07-07 18:23:44 -07:00
asm-v850 [PATCH] PCI: fix up errors after dma bursting patch and CONFIG_PCI=n 2005-06-27 21:52:46 -07:00
asm-x86_64 [PATCH] MTRR suspend/resume cleanup 2005-07-07 18:23:42 -07:00
asm-xtensa [PATCH] xtensa: remove old syscalls 2005-07-07 18:23:44 -07:00
linux [PATCH] namespace.c: fix race in mark_mounts_for_expiry() 2005-07-07 18:23:51 -07:00
math-emu Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
media [PATCH] v4l: tuner improvements 2005-06-28 21:20:36 -07:00
mtd Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
net [TCP]: Move to new TSO segmenting scheme. 2005-07-05 15:24:38 -07:00
pcmcia [PATCH] pcmcia: ds.c cleanup 2005-06-27 18:03:20 -07:00
rxrpc Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
scsi [PATCH] I2O: Adaptec specific SG_IO access, firmware access through sysfs and 2400A workaround 2005-06-24 00:05:28 -07:00
sound [PATCH] create a kstrdup library function 2005-06-23 09:45:18 -07:00
video [PATCH] Clean-up and bug fix for tdfxfb framebuffer size detection 2005-05-01 08:59:25 -07:00