Merge "fs: namespace: Fix use-after-free in unmount" (2983c636) · Commits · e / devices / android_kernel_xiaomi_nabu

fs/namespace.c

+6 −6

Original line number	Diff line number	Diff line
		@@ -1691,6 +1691,12 @@ int ksys_umount(char __user *name, int flags)
		dput_and_out:
		/* we mustn't call path_put() as that would clear mnt_expiry_mark */
		dput(path.dentry);
		if (user_request && (!retval \|\| (flags & MNT_FORCE))) {
		/* filesystem needs to handle unclosed namespaces */
		if (mnt->mnt.mnt_sb->s_op->umount_end)
		mnt->mnt.mnt_sb->s_op->umount_end(mnt->mnt.mnt_sb,
		flags);
		}
		mntput_no_expire(mnt);

		if (!user_request)
		@@ -1707,12 +1713,6 @@ int ksys_umount(char __user *name, int flags)
		/* flush delayed_mntput_work to put sb->s_active */
		flush_delayed_mntput_wait();
		}
		if (!retval \|\| (flags & MNT_FORCE)) {
		/* filesystem needs to handle unclosed namespaces */
		if (mnt->mnt.mnt_sb->s_op->umount_end)
		mnt->mnt.mnt_sb->s_op->umount_end(mnt->mnt.mnt_sb,
		flags);
		}
		out:
		return retval;
		}