| Age | Commit message (Expand) | Author | Files | Lines |
|---|
| 2017-02-10 | Merge tag 'mac80211-next-for-davem-2017-02-09' of git://git.kernel.org/pub/sc... | David S. Miller | 4 | -40/+114 |
| 2017-02-09 | cfg80211: fix NAN bands definition | Luca Coelho | 3 | -17/+37 |
| 2017-02-08 | cfg80211: Pass new RSSI level in CQM RSSI notification | Andrzej Zaborowski | 2 | -6/+14 |
| 2017-02-08 | nl80211: fix validation of scheduled scan info for wowlan netdetect | Arend Van Spriel | 1 | -4/+6 |
| 2017-02-08 | nl80211: add HT/VHT capabilities to AP parameters | Johannes Berg | 1 | -1/+46 |
| 2017-02-08 | cfg80211: make rdev assignment clearer in nl80211_testmode_dump() | Luca Coelho | 1 | -7/+6 |
| 2017-02-08 | cfg80211 debugfs: Cleanup some checkpatch issues | Pichugin Dmitry | 1 | -5/+5 |
| 2017-02-07 | Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net | David S. Milleras added to mntput_no_expire. At which
point it became possible for multiple calls of put_mountpoint on
the same hash chain to happen on the same time.
Kristen Johansen <kjlx@templeofstupid.com> reported:
> This can cause a panic when simultaneous callers of put_mountpoint
> attempt to free the same mountpoint. This occurs because some callers
> hold the mount_hash_lock, while others hold the namespace lock. Some
> even hold both.
>
> In this submitter's case, the panic manifested itself as a GP fault in
> put_mountpoint() when it called hlist_del() and attempted to dereference
> a m_hash.pprev that had been poisioned by another thread.
Al Viro observed that the simple fix is to switch from using the namespace_sem
to the mount_lock to protect the mountpoint hash table.
I have taken Al's suggested patch moved put_mountpoint in pivot_root
(instead of taking mount_lock an additional time), and have replaced
new_mountpoint with get_mountpoint a function that does the hash table
lookup and addition under the mount_lock. The introduction of get_mounptoint
ensures that only the mount_lock is needed to manipulate the mountpoint
hashtable.
d_set_mounted is modified to only set DCACHE_MOUNTED if it is not
already set. This allows get_mountpoint to use the setting of
DCACHE_MOUNTED to ensure adding a struct mountpoint for a dentry
happens exactly once.
Cc: stable@vger.kernel.org
Fixes: ce07d891a089 ("mnt: Honor MNT_LOCKED when detaching mounts")
Reported-by: Krister Johansen <kjlx@templeofstupid.com>
Suggested-by: Al Viro <viro@ZenIV.linux.org.uk>
Acked-by: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
|
