Commit be1a16a0 authored by Miklos Szeredi's avatar Miklos Szeredi Committed by Al Viro

vfs: fix infinite loop caused by clone_mnt race

If clone_mnt() happens while mnt_make_readonly() is running, the
cloned mount might have MNT_WRITE_HOLD flag set, which results in
mnt_want_write() spinning forever on this mount.

Needs CAP_SYS_ADMIN to trigger deliberately and unlikely to happen
accidentally.  But if it does happen it can hang the machine.
Signed-off-by: default avatarMiklos Szeredi <mszeredi@suse.cz>
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent 89b0fc38
...@@ -595,7 +595,7 @@ static struct vfsmount *clone_mnt(struct vfsmount *old, struct dentry *root, ...@@ -595,7 +595,7 @@ static struct vfsmount *clone_mnt(struct vfsmount *old, struct dentry *root,
goto out_free; goto out_free;
} }
mnt->mnt_flags = old->mnt_flags; mnt->mnt_flags = old->mnt_flags & ~MNT_WRITE_HOLD;
atomic_inc(&sb->s_active); atomic_inc(&sb->s_active);
mnt->mnt_sb = sb; mnt->mnt_sb = sb;
mnt->mnt_root = dget(root); mnt->mnt_root = dget(root);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment