[PATCH] namei fixes (16/19)
authorAl Viro <viro@www.linux.org.uk>
Mon, 6 Jun 2005 20:36:12 +0000 (13:36 -0700)
committerLinus Torvalds <torvalds@ppc970.osdl.org>
Mon, 6 Jun 2005 21:42:27 +0000 (14:42 -0700)
Conditional mntput() moved into __do_follow_link().  There it collapses with
unconditional mntget() on the same sucker, closing another too-early-mntput()
race.

Signed-off-by: Al Viro <viro@parcelfarce.linux.theplanet.co.uk>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
fs/namei.c

index 6a884682b0a7e8a7280427cdaeb1c5fd70f21f9f..444086d441e12376b721e58b70ed32d23911167b 100644 (file)
@@ -506,7 +506,8 @@ static inline int __do_follow_link(struct path *path, struct nameidata *nd)
        touch_atime(nd->mnt, dentry);
        nd_set_link(nd, NULL);
 
-       mntget(path->mnt);
+       if (path->mnt == nd->mnt)
+               mntget(path->mnt);
        error = dentry->d_inode->i_op->follow_link(dentry, nd);
        if (!error) {
                char *s = nd_get_link(nd);
@@ -543,8 +544,6 @@ static inline int do_follow_link(struct path *path, struct nameidata *nd)
        current->link_count++;
        current->total_link_count++;
        nd->depth++;
-       if (path->mnt != nd->mnt)
-               mntput(path->mnt);
        err = __do_follow_link(path, nd);
        current->link_count--;
        nd->depth--;
@@ -1550,8 +1549,6 @@ do_link:
        error = security_inode_follow_link(path.dentry, nd);
        if (error)
                goto exit_dput;
-       if (nd->mnt != path.mnt)
-               mntput(path.mnt);
        error = __do_follow_link(&path, nd);
        if (error)
                return error;