)]}'
{
  "commit": "1ce88cf466f7b6078b14d67d186a3d7c19dd5609",
  "tree": "b9716f3a71e3285a998da9614cfbc132ca605542",
  "parents": [
    "202322e6f7cd12e82b5ff0fa92bbdf517fcf0947"
  ],
  "author": {
    "name": "Miklos Szeredi",
    "email": "miklos@szeredi.hu",
    "time": "Thu Jul 07 17:57:24 2005 -0700"
  },
  "committer": {
    "name": "Linus Torvalds",
    "email": "torvalds@g5.osdl.org",
    "time": "Thu Jul 07 18:23:51 2005 -0700"
  },
  "message": "[PATCH] namespace.c: fix race in mark_mounts_for_expiry()\n\nThis patch fixes a race found by Ram in mark_mounts_for_expiry() in\nfs/namespace.c.\n\nThe bug can only be triggered with simultaneous exiting of a process having\na private namespace, and expiry of a mount from within that namespace.\nIt\u0027s practically impossible to trigger, and I haven\u0027t even tried.  But\nstill, a bug is a bug.\n\nThe race happens when put_namespace() is called by another task, while\nmark_mounts_for_expiry() is between atomic_read() and get_namespace().  In\nthat case get_namespace() will be called on an already dead namespace with\nunforeseeable results.\n\nThe solution was suggested by Al Viro, with his own words:\n\n      Instead of screwing with atomic_read() in there, why don\u0027t we\n      simply do the following:\n      \ta) atomic_dec_and_lock() in put_namespace()\n      \tb) __put_namespace() called without dropping lock\n      \tc) the first thing done by __put_namespace would be\n      struct vfsmount *root \u003d namespace-\u003eroot;\n      namespace-\u003eroot \u003d NULL;\n      spin_unlock(...);\n      ....\n      umount_tree(root);\n      ...\n      \td) check in mark_... would be simply namespace \u0026\u0026 namespace-\u003eroot.\n\n      And we are all set; no screwing around with atomic_read(), no magic\n      at all.  Dying namespace gets NULL -\u003eroot.\n      All changes of -\u003eroot happen under spinlock.\n      If under a spinlock we see non-NULL -\u003emnt_namespace, it won\u0027t be\n      freed until we drop the lock (we will set -\u003emnt_namespace to NULL\n      under that lock before we get to freeing namespace).\n      If under a spinlock we see non-NULL -\u003emnt_namespace and\n      -\u003emnt_namespace-\u003eroot, we can grab a reference to namespace and be\n      sure that it won\u0027t go away.\n\nSigned-off-by: Miklos Szeredi \u003cmiklos@szeredi.hu\u003e\nAcked-by: Al Viro \u003cviro@parcelfarce.linux.theplanet.co.uk\u003e\nAcked-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "a0d0ef1f1a4864f453b95fc39f10888b1b19b222",
      "old_mode": 33188,
      "old_path": "fs/namespace.c",
      "new_id": "9d17541ebafa0327536a6f18526676cdcb3e878a",
      "new_mode": 33188,
      "new_path": "fs/namespace.c"
    },
    {
      "type": "modify",
      "old_id": "697991b69f9b6d09e7d18f087490e66b018a78d1",
      "old_mode": 33188,
      "old_path": "include/linux/namespace.h",
      "new_id": "0e5a86f13b2f8b4bbac4b50f32836827fef9fae8",
      "new_mode": 33188,
      "new_path": "include/linux/namespace.h"
    }
  ]
}