]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
projects / thirdparty / kernel / stable.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: b464133) | patch
mount_subtree() pointless use-after-free
authorAl Viro <viro@zeniv.linux.org.uk>
Tue, 22 Nov 2011 17:31:21 +0000 (12:31 -0500)
committerAl Viro <viro@zeniv.linux.org.uk>
Tue, 22 Nov 2011 17:31:21 +0000 (12:31 -0500)
commitd31da0f0ba3bc0a827a63879310818c22d9a95be
treed89bbdf299c4cbc37f49a9964b8127f09eedd50btree | snapshot
parentb46413367961c2e8bd827e067a231be982aaeee2commit | diff
mount_subtree() pointless use-after-free

d'oh... we'd carefully pinned mnt->mnt_sb down, dropped mnt and attempt
to grab s_umount on mnt->mnt_sb.  The trouble is, *mnt might've been
overwritten by now...

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
fs/namespace.c diff | blob | blame | history
Mirror https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git