tree 8fed20ac96c431141bbe45b74da676ea28e17ade
parent eb608706c14d66b2e2084b5fa34e73472416f23f
author Sayali Lokhande <sayalil@codeaurora.org> 1578561319 +0530
committer Alexander Martinz <amartinz@shiftphones.com> 1665747040 +0200

fs: namespace: Fix use-after-free in unmount

During unmount, there is a chance that mntput_no_expire()
scheduled delayed_mntput_work() or in case MNT_INTERNAL
flag is set it can directly call cleanup_mnt().
This results in use-after-free in umount_end check as
mnt is already freed via below path :
cleanup_mnt()->delayed_free_mnt()->free_vfsmnt().

Fix this by moving unmount_end() before mntput_no_expire.

Change-Id: Ib3468ca3b1b3c137484b70972db5d5569f2f2753
Signed-off-by: Sayali Lokhande <sayalil@codeaurora.org>