Commit 47e624c0 authored Nov 14, 2018 by Linus Torvalds

user-namespace

Pull namespace fix from Eric Biederman:
 "Benjamin Coddington noticed an unkillable busy loop in the kernel that
  anyone who is sufficiently motivated can trigger. This bug did not
  exist in earlier kernels making this bug a regression.

  I have tested the change personally and confirmed that the bug exists
  and that the fix works. This fix has been picked up by linux-next and
  hopefully the automated testing bots and no problems have been
  reported from those sources.

  Ordinarily I would let something like this sit a little longer but I
  am going to be away at Linux Plumbers the rest of this week and I am
  afraid if I don't send the pull request now this fix will get lost"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace:
  mnt: fix __detach_mounts infinite loop

parents 857c34cd 1e9c75fb

fs/namespace.c

+3 −3

Original line number	Diff line number	Diff line
		@@ -695,9 +695,6 @@ static struct mountpoint lookup_mountpoint(struct dentry dentry)

		hlist_for_each_entry(mp, chain, m_hash) {
		if (mp->m_dentry == dentry) {
		/* might be worth a WARN_ON() */
		if (d_unlinked(dentry))
		return ERR_PTR(-ENOENT);
		mp->m_count++;
		return mp;
		}
		@@ -711,6 +708,9 @@ static struct mountpoint get_mountpoint(struct dentry dentry)
		int ret;

		if (d_mountpoint(dentry)) {
		/* might be worth a WARN_ON() */
		if (d_unlinked(dentry))
		return ERR_PTR(-ENOENT);
		mountpoint:
		read_seqlock_excl(&mount_lock);
		mp = lookup_mountpoint(dentry);

Admin message