mnt: In detach_mounts detach the appropriate unmounted mount

The handling of in detach_mounts of unmounted but connected mounts is
buggy and can lead to an infinite loop.

Correct the handling of unmounted mounts in detach_mount.  When the
mountpoint of an unmounted but connected mount is connected to a
dentry, and that dentry is deleted we need to disconnect that mount
from the parent mount and the deleted dentry.

Nothing changes for the unmounted and connected children.  They can be
safely ignored.

Cc: stable@vger.kernel.org
Fixes: ce07d891a0891d3c0d0c2d73d577490486b809e1 mnt: Honor MNT_LOCKED when detaching mounts
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>

1 files changed, 2 insertions, 5 deletions

diff --git a/fs/namespace.c b/fs/namespace.c
index 7829eab0b706..2b8aa15fd6df 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1565,11 +1565,8 @@ void __detach_mounts(struct dentry *dentry)
         while (!hlist_empty(&mp->m_list)) {
                 mnt = hlist_entry(mp->m_list.first, struct mount, mnt_mp_list);
                 if (mnt->mnt.mnt_flags & MNT_UMOUNT) {
-                        struct mount *p, *tmp;
-                        list_for_each_entry_safe(p, tmp, &mnt->mnt_mounts,  mnt_child) {
-                                hlist_add_head(&p->mnt_umount.s_list, &unmounted);
-                                umount_mnt(p);
-                        }
+                        hlist_add_head(&mnt->mnt_umount.s_list, &unmounted);
+                        umount_mnt(mnt);
                 }
                 else umount_tree(mnt, UMOUNT_CONNECTED);
         }