提交 39ca6d49 编写于 作者: A Al Viro 提交者: Linus Torvalds

[PATCH] namei fixes (16/19)

Conditional mntput() moved into __do_follow_link().  There it collapses with
unconditional mntget() on the same sucker, closing another too-early-mntput()
race.
Signed-off-by: NAl Viro <viro@parcelfarce.linux.theplanet.co.uk>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>
上级 d9d29a29
......@@ -506,6 +506,7 @@ static inline int __do_follow_link(struct path *path, struct nameidata *nd)
touch_atime(nd->mnt, dentry);
nd_set_link(nd, NULL);
if (path->mnt == nd->mnt)
mntget(path->mnt);
error = dentry->d_inode->i_op->follow_link(dentry, nd);
if (!error) {
......@@ -543,8 +544,6 @@ static inline int do_follow_link(struct path *path, struct nameidata *nd)
current->link_count++;
current->total_link_count++;
nd->depth++;
if (path->mnt != nd->mnt)
mntput(path->mnt);
err = __do_follow_link(path, nd);
current->link_count--;
nd->depth--;
......@@ -1550,8 +1549,6 @@ int open_namei(const char * pathname, int flag, int mode, struct nameidata *nd)
error = security_inode_follow_link(path.dentry, nd);
if (error)
goto exit_dput;
if (nd->mnt != path.mnt)
mntput(path.mnt);
error = __do_follow_link(&path, nd);
if (error)
return error;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册