This patch clears mnt_namespace on unmount.
Not clearing mnt_namespace has two effects:
1) It is possible to attach a new mount to a detached mount,
because check_mnt() returns true.
This means, that when no other references to the detached mount
remain, it still can't be freed. This causes a resource leak,
and possibly un-removable modules.
2) If mnt_namespace is dereferenced (only in mark_mounts_for_expiry())
after the namspace has been freed, it can cause an Oops, memory
corruption, etc.
1) has been tested before and after the patch, 2) is only speculation.
Signed-off-by: Miklos Szeredi <[email protected]>
Index: linux/fs/namespace.c
===================================================================
--- linux.orig/fs/namespace.c 2005-05-16 21:02:54.000000000 +0200
+++ linux/fs/namespace.c 2005-05-16 21:20:10.000000000 +0200
@@ -345,6 +345,7 @@ static void umount_tree(struct vfsmount
for (p = mnt; p; p = next_mnt(p, mnt)) {
list_del(&p->mnt_list);
list_add(&p->mnt_list, &kill);
+ p->mnt_namespace = NULL;
}
while (!list_empty(&kill)) {
@@ -1449,15 +1450,8 @@ void __init mnt_init(unsigned long mempa
void __put_namespace(struct namespace *namespace)
{
- struct vfsmount *mnt;
-
down_write(&namespace->sem);
spin_lock(&vfsmount_lock);
-
- list_for_each_entry(mnt, &namespace->list, mnt_list) {
- mnt->mnt_namespace = NULL;
- }
-
umount_tree(namespace->root);
spin_unlock(&vfsmount_lock);
up_write(&namespace->sem);
Miklos Szeredi wrote:
> This patch clears mnt_namespace on unmount.
>
> Not clearing mnt_namespace has two effects:
>
> 1) It is possible to attach a new mount to a detached mount,
> because check_mnt() returns true.
>
> This means, that when no other references to the detached mount
> remain, it still can't be freed. This causes a resource leak,
> and possibly un-removable modules.
>
> 2) If mnt_namespace is dereferenced (only in mark_mounts_for_expiry())
> after the namspace has been freed, it can cause an Oops, memory
> corruption, etc.
>
> 1) has been tested before and after the patch, 2) is only speculation.
You're right - I was just thinking the same thing. There is also
another side effect, which is ironic in the context of recent discussion:
3) Because mnt_namespace may refer to freed memory, it may refer
to memory that's then allocated for _another_ namespace. So the
check for mounting in the correct namespace which prevents
recursive bind mounts could erronously _allow_ the recursive
bind to succeed (though without taking the correct lock).
-- Jamie