Commit 39ca6d49 authored by Al Viro's avatar Al Viro Committed by Linus Torvalds
Browse files

[PATCH] namei fixes (16/19) 



Conditional mntput() moved into __do_follow_link().  There it collapses with
unconditional mntget() on the same sucker, closing another too-early-mntput()
race.

Signed-off-by: default avatarAl Viro <viro@parcelfarce.linux.theplanet.co.uk>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent d9d29a29

fs/namei.c

+2 −5
Original line number Diff line number Diff line
@@ -506,6 +506,7 @@ static inline int __do_follow_link(struct path *path, struct nameidata *nd) 
	touch_atime(nd->mnt, dentry);

	nd_set_link(nd, NULL);



	if (path->mnt == nd->mnt)

		mntget(path->mnt);

	error = dentry->d_inode->i_op->follow_link(dentry, nd);

	if (!error) {
@@ -543,8 +544,6 @@ static inline int do_follow_link(struct path *path, struct nameidata *nd) 
	current->link_count++;

	current->total_link_count++;

	nd->depth++;

	if (path->mnt != nd->mnt)

		mntput(path->mnt);

	err = __do_follow_link(path, nd);

	current->link_count--;

	nd->depth--;
@@ -1550,8 +1549,6 @@ int open_namei(const char * pathname, int flag, int mode, struct nameidata *nd) 
	error = security_inode_follow_link(path.dentry, nd);

	if (error)

		goto exit_dput;

	if (nd->mnt != path.mnt)

		mntput(path.mnt);

	error = __do_follow_link(&path, nd);

	if (error)

		return error;