Messages in this thread | | | From | Linus Torvalds <> | Date | Wed, 14 Oct 2020 14:49:18 -0700 | Subject | Re: [PATCH] fs: fix NULL dereference due to data race in prepend_path() |
| |
On Wed, Oct 14, 2020 at 2:40 PM Andrii Nakryiko <andrii@kernel.org> wrote: > > Fix data race in prepend_path() with re-reading mnt->mnt_ns twice without > holding the lock. is_mounted() does check for NULL, but is_anon_ns(mnt->mnt_ns) > might re-read the pointer again which could be NULL already, if in between > reads one of kern_unmount()/kern_unmount_array()/umount_tree() sets mnt->mnt_ns > to NULL.
This seems like the obviously correct fix, so I think I'll just apply it directly.
Al? Holler if you have any issues with this..
Linus
| |