tree 6bdb0af25cc30d7bc8a8d54db3625f8486c2f5f9
parent 1cf6e7d83bf334cc5916137862c920a97aabc018
author Li Zefan <lizf@cn.fujitsu.com> 1234997300 -0800
committer Linus Torvalds <torvalds@linux-foundation.org> 1235000274 -0800

cgroups: fix possible use after free

In cgroup_kill_sb(), root is freed before sb is detached from the list, so
another sget() may find this sb and call cgroup_test_super(), which will
access the root that has been freed.

Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
Acked-by: Paul Menage <menage@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>