Commit 9e3fea16ba386fa549a0b2de8a203e5d412997a0
Committed by
Al Viro
1 parent
6651149371
Exists in
master
and in
7 other branches
autofs4: Fix wait validation
It is possible for the check in wait.c:validate_request() to return an incorrect result if the dentry that was mounted upon has changed during the callback. Signed-off-by: Ian Kent <raven@themaw.net> Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Showing 1 changed file with 16 additions and 1 deletions Side-by-side Diff
fs/autofs4/waitq.c
... | ... | @@ -309,6 +309,9 @@ |
309 | 309 | * completed while we waited on the mutex ... |
310 | 310 | */ |
311 | 311 | if (notify == NFY_MOUNT) { |
312 | + struct dentry *new = NULL; | |
313 | + int valid = 1; | |
314 | + | |
312 | 315 | /* |
313 | 316 | * If the dentry was successfully mounted while we slept |
314 | 317 | * on the wait queue mutex we can return success. If it |
315 | 318 | |
... | ... | @@ -316,8 +319,20 @@ |
316 | 319 | * a multi-mount with no mount at it's base) we can |
317 | 320 | * continue on and create a new request. |
318 | 321 | */ |
322 | + if (!IS_ROOT(dentry)) { | |
323 | + if (dentry->d_inode && d_unhashed(dentry)) { | |
324 | + struct dentry *parent = dentry->d_parent; | |
325 | + new = d_lookup(parent, &dentry->d_name); | |
326 | + if (new) | |
327 | + dentry = new; | |
328 | + } | |
329 | + } | |
319 | 330 | if (have_submounts(dentry)) |
320 | - return 0; | |
331 | + valid = 0; | |
332 | + | |
333 | + if (new) | |
334 | + dput(new); | |
335 | + return valid; | |
321 | 336 | } |
322 | 337 | |
323 | 338 | return 1; |