Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1644ccc8 authored by Al Viro's avatar Al Viro
Browse files

Safer nfsd_cross_mnt() 



AFAICS, we have a subtle bug there: if we have crossed mountpoint
*and* it got mount --move'd away, we'll be holding only one
reference to fs containing dentry - exp->ex_path.mnt.  IOW, we
ought to dput() before exp_put().

Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent e5d67f07

fs/nfsd/vfs.c

+7 −2
Original line number Diff line number Diff line
@@ -116,10 +116,15 @@ nfsd_cross_mnt(struct svc_rqst *rqstp, struct dentry **dpp, 
	}

	if ((exp->ex_flags & NFSEXP_CROSSMOUNT) || EX_NOHIDE(exp2)) {

		/* successfully crossed mount point */

		exp_put(exp);

		*expp = exp2;

		/*

		 * This is subtle: dentry is *not* under mnt at this point.

		 * The only reason we are safe is that original mnt is pinned

		 * down by exp, so we should dput before putting exp.

		 */

		dput(dentry);

		*dpp = mounts;

		exp_put(exp);

		*expp = exp2;

	} else {

		exp_put(exp2);

		dput(mounts);