| commit | d31da0f0ba3bc0a827a63879310818c22d9a95be | [log] [tgz] |
|---|---|---|
| author | Al Viro <viro@zeniv.linux.org.uk> | Tue Nov 22 12:31:21 2011 -0500 |
| committer | Al Viro <viro@zeniv.linux.org.uk> | Tue Nov 22 12:31:21 2011 -0500 |
| tree | d89bbdf299c4cbc37f49a9964b8127f09eedd50b | |
| parent | b46413367961c2e8bd827e067a231be982aaeee2 [diff] |
mount_subtree() pointless use-after-free d'oh... we'd carefully pinned mnt->mnt_sb down, dropped mnt and attempt to grab s_umount on mnt->mnt_sb. The trouble is, *mnt might've been overwritten by now... Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>