Patch "mnt: On an unmount propagate clearing of MNT_LOCKED" has been added to the 4.0-stable tree

This is a note to let you know that I've just added the patch titled

mnt: On an unmount propagate clearing of MNT_LOCKED

to the 4.0-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
mnt-on-an-unmount-propagate-clearing-of-mnt_locked.patch
and it can be found in the queue-4.0 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: "Eric W. Biederman" <[email protected]>
Date: Sat, 3 Jan 2015 05:39:35 -0600
Subject: mnt: On an unmount propagate clearing of MNT_LOCKED

From: "Eric W. Biederman" <[email protected]>

commit 5d88457eb5b86b475422dc882f089203faaeedb5 upstream.

A prerequisite of calling umount_tree is that the point where the tree is mounted at is valid to unmount.

If we are propagating the effect of the unmount clear MNT_LOCKED in every instance where the same filesystem is mounted on the same mountpoint in the mount tree, as we know (by virtue of the fact that umount_tree was called) that it is safe to reveal what is at that mountpoint.

---
 fs/namespace.c |    3 +++
 fs/pnode.c     |   20 ++++++++++++++++++++
 fs/pnode.h     |    1 +
 3 files changed, 24 insertions(+)

@@ -1335,6 +1335,9 @@ static void umount_tree(struct mount *mn
 	LIST_HEAD(tmp_list);
 	struct mount *p;
 
+	if (how & UMOUNT_PROPAGATE)
+		propagate_mount_unlock(mnt);
+
 	/* Gather the mounts to umount */
 	for (p = mnt; p; p = next_mnt(p, mnt)) {
 		p->mnt.mnt_flags |= MNT_UMOUNT;

@@ -362,6 +362,26 @@ int propagate_mount_busy(struct mount *m
 }
 
 /*
+ * Clear MNT_LOCKED when it can be shown to be safe.
+ *
+ * mount_lock lock must be held for write
+ */
+void propagate_mount_unlock(struct mount *mnt)
+{
+	struct mount *parent = mnt->mnt_parent;
+	struct mount *m, *child;
+
+	BUG_ON(parent == mnt);
+
+	for (m = propagation_next(parent, parent); m;
+			m = propagation_next(m, parent)) {
+		child = __lookup_mnt_last(&m->mnt, mnt->mnt_mountpoint);
+		if (child)
+			child->mnt.mnt_flags &= ~MNT_LOCKED;
+	}
+}
+
+/*
  * NOTE: unmounting 'mnt' naturally propagates to all other mounts its
  * parent propagates to.
  */

@@ -42,6 +42,7 @@ int propagate_mnt(struct mount *, struct
 		struct hlist_head *);
 int propagate_umount(struct list_head *);
 int propagate_mount_busy(struct mount *, int);
+void propagate_mount_unlock(struct mount *);
 void mnt_release_group_id(struct mount *);
 int get_dominating_id(struct mount *mnt, const struct path *root);
 unsigned int mnt_get_count(struct mount *mnt);

Patches currently in stable-queue which might be from [email protected] are

queue-4.0/mnt-don-t-propagate-umounts-in-__detach_mounts.patch queue-4.0/mnt-add-mnt_umount-flag.patch queue-4.0/mnt-honor-mnt_locked-when-detaching-mounts.patch queue-4.0/mnt-delay-removal-from-the-mount-hash.patch queue-4.0/mnt-on-an-unmount-propagate-clearing-of-mnt_locked.patch queue-4.0/mnt-don-t-propagate-unmounts-to-locked-mounts.patch queue-4.0/mnt-factor-out-unhash_mnt-from-detach_mnt-and-umount_tree.patch queue-4.0/mnt-factor-umount_mnt-from-umount_tree.patch queue-4.0/mnt-fix-the-error-check-in-__detach_mounts.patch queue-4.0/mnt-update-detach_mounts-to-leave-mounts-connected.patch queue-4.0/mnt-improve-the-umount_tree-flags.patch queue-4.0/mnt-in-umount_tree-reuse-mnt_list-instead-of-mnt_hash.patch