attach_recursive_mnt() needs to hold vfsmount_lock over set_mnt_shared()

race in mnt_flags update

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

1 files changed, 2 insertions, 2 deletions

diff --git a/fs/namespace.c b/fs/namespace.c
index 461090a57b33..4de493ea67cf 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1354,12 +1354,12 @@ static int attach_recursive_mnt(struct vfsmount *source_mnt,
         if (err)
                 goto out_cleanup_ids;
 
+        spin_lock(&vfsmount_lock);
+
         if (IS_MNT_SHARED(dest_mnt)) {
                 for (p = source_mnt; p; p = next_mnt(p, source_mnt))
                         set_mnt_shared(p);
         }
-
-        spin_lock(&vfsmount_lock);
         if (parent_path) {
                 detach_mnt(source_mnt, parent_path);
                 attach_mnt(source_mnt, path);