]> git.baikalelectronics.ru Git - kernel.git/commit
projects / kernel.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: eeb7fcf) | patch
mount_subtree() pointless use-after-free
authorAl Viro <viro@zeniv.linux.org.uk>
Tue, 22 Nov 2011 17:31:21 +0000 (12:31 -0500)
committerAl Viro <viro@zeniv.linux.org.uk>
Tue, 22 Nov 2011 17:31:21 +0000 (12:31 -0500)
commite4a8309cde783132a1b09f684c7476d0b5de575a
treed89bbdf299c4cbc37f49a9964b8127f09eedd50btree | snapshot
parenteeb7fcfb7853c7ea91739072464ffc3e2aa52f62commit | diff
mount_subtree() pointless use-after-free

d'oh... we'd carefully pinned mnt->mnt_sb down, dropped mnt and attempt
to grab s_umount on mnt->mnt_sb.  The trouble is, *mnt might've been
overwritten by now...

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
fs/namespace.c diff | blob | history
Linux Kernel Source Tree.