Al Viro d31da0f0ba mount_subtree() pointless use-after-free ...

d'oh... we'd carefully pinned mnt->mnt_sb down, dropped mnt and attempt
to grab s_umount on mnt->mnt_sb.  The trouble is, *mnt might've been
overwritten by now...

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

2011-11-22 12:31:21 -05:00

66 KiB

Raw Blame History

View Raw