projects / linux-2.6-block.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: b464133) | patch
mount_subtree() pointless use-after-free
authorAl Viro <viro@zeniv.linux.org.uk>
Tue, 22 Nov 2011 17:31:21 +0000 (12:31 -0500)
committerAl Viro <viro@zeniv.linux.org.uk>
Tue, 22 Nov 2011 17:31:21 +0000 (12:31 -0500)
commitd31da0f0ba3bc0a827a63879310818c22d9a95be
treed89bbdf299c4cbc37f49a9964b8127f09eedd50btree | snapshot
parentb46413367961c2e8bd827e067a231be982aaeee2commit | diff
mount_subtree() pointless use-after-free

d'oh... we'd carefully pinned mnt->mnt_sb down, dropped mnt and attempt
to grab s_umount on mnt->mnt_sb.  The trouble is, *mnt might've been
overwritten by now...

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
fs/namespace.c diff | blob | blame | history
Linux 6.x block layer and io_uring tree(s)