From: Al Viro <viro@zeniv.linux.org.uk>
Date: Fri, 21 Sep 2012 12:19:02 +0000 (-0400)
Subject: do_add_mount()/umount -l races
X-Git-Tag: v3.6~6^2~1
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=156cacb1d0d36b0d0582d9e798e58e0044f516b3;p=pandora-kernel.git

do_add_mount()/umount -l races

normally we deal with lock_mount()/umount races by checking that
mountpoint to be is still in our namespace after lock_mount() has
been done.  However, do_add_mount() skips that check when called
with MNT_SHRINKABLE in flags (i.e. from finish_automount()).  The
reason is that ->mnt_ns may be a temporary namespace created exactly
to contain automounts a-la NFS4 referral handling.  It's not the
namespace of the caller, though, so check_mnt() would fail here.
We still need to check that ->mnt_ns is non-NULL in that case,
though.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---

Reading git-diff-tree failed