Merge "fs: namespace: Fix use-after-free in unmount" (2a67b245) · Commits · e / devices / android_kernel_xiaomi_sm6125

fs/namespace.c

+6 −5

Original line number	Diff line number	Diff line
		@@ -1778,6 +1778,12 @@ SYSCALL_DEFINE2(umount, char __user *, name, int, flags)
		dput_and_out:
		/* we mustn't call path_put() as that would clear mnt_expiry_mark */
		dput(path.dentry);
		if (user_request && (!retval \|\| (flags & MNT_FORCE))) {
		/* filesystem needs to handle unclosed namespaces */
		if (mnt->mnt.mnt_sb->s_op->umount_end)
		mnt->mnt.mnt_sb->s_op->umount_end(mnt->mnt.mnt_sb,
		flags);
		}
		mntput_no_expire(mnt);

		if (!user_request)
		@@ -1794,11 +1800,6 @@ SYSCALL_DEFINE2(umount, char __user *, name, int, flags)
		/* flush delayed_mntput_work to put sb->s_active */
		flush_delayed_mntput_wait();
		}
		if (!retval \|\| (flags & MNT_FORCE)) {
		/* filesystem needs to handle unclosed namespaces */
		if (mnt->mnt.mnt_sb->s_op->umount_end)
		mnt->mnt.mnt_sb->s_op->umount_end(mnt->mnt.mnt_sb, flags);
		}
		out:
		return retval;
		}