diff options
author | Linus Torvalds <torvalds@linux-foundation.org> | 2019-05-07 14:17:26 -0400 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2019-05-07 14:17:26 -0400 |
commit | 78438ce18f26dbcaa8993bb45d20ffb0cec3bc3e (patch) | |
tree | 2f6fe2eb05296a410a44ee7d602cafe2d202467b /kernel | |
parent | 168e153d5ebbdd6a3fa85db1cc4879ed4b7030e0 (diff) | |
parent | ce285c267a003acbf607f3540ff71287f82e5282 (diff) |
Merge branch 'stable-fodder' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
Pull vfs stable fodder fixes from Al Viro:
- acct_on() fix for deadlock caught by overlayfs folks
- autofs RCU use-after-free SNAFU (->d_manage() can be called
locklessly, so we need to RCU-delay freeing the objects it looks at)
- (hopefully) the end of "do we need freeing this dentry RCU-delayed"
whack-a-mole.
* 'stable-fodder' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
autofs: fix use-after-free in lockless ->d_manage()
dcache: sort the freeing-without-RCU-delay mess for good.
acct_on(): don't mess with freeze protection
Diffstat (limited to 'kernel')
-rw-r--r-- | kernel/acct.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/kernel/acct.c b/kernel/acct.c index addf7732fb56..81f9831a7859 100644 --- a/kernel/acct.c +++ b/kernel/acct.c | |||
@@ -227,7 +227,7 @@ static int acct_on(struct filename *pathname) | |||
227 | filp_close(file, NULL); | 227 | filp_close(file, NULL); |
228 | return PTR_ERR(internal); | 228 | return PTR_ERR(internal); |
229 | } | 229 | } |
230 | err = mnt_want_write(internal); | 230 | err = __mnt_want_write(internal); |
231 | if (err) { | 231 | if (err) { |
232 | mntput(internal); | 232 | mntput(internal); |
233 | kfree(acct); | 233 | kfree(acct); |
@@ -252,7 +252,7 @@ static int acct_on(struct filename *pathname) | |||
252 | old = xchg(&ns->bacct, &acct->pin); | 252 | old = xchg(&ns->bacct, &acct->pin); |
253 | mutex_unlock(&acct->lock); | 253 | mutex_unlock(&acct->lock); |
254 | pin_kill(old); | 254 | pin_kill(old); |
255 | mnt_drop_write(mnt); | 255 | __mnt_drop_write(mnt); |
256 | mntput(mnt); | 256 | mntput(mnt); |
257 | return 0; | 257 | return 0; |
258 | } | 258 | } |