Patch "namespace: update event counter when umounting a deleted dentry" has been added to the 4.4-stable tree

This is a note to let you know that I've just added the patch titled

namespace: update event counter when umounting a deleted dentry

to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
namespace-update-event-counter-when-umounting-a-deleted-dentry.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Andrey Ulanov <[email protected]>
Date: Fri, 15 Apr 2016 14:24:41 -0700
Subject: namespace: update event counter when umounting a deleted dentry

From: Andrey Ulanov <[email protected]>

commit e06b933e6ded42384164d28a2060b7f89243b895 upstream.

- m_start() in fs/namespace.c expects that ns->event is incremented each time a mount added or removed from ns->list.
- umount_tree() removes items from the list but does not increment event counter, expecting that it's done before the function is called.
- There are some codepaths that call umount_tree() without updating "event" counter. e.g. from __detach_mounts().
- When this happens m_start may reuse a cached mount structure that no longer belongs to ns->list (i.e. use after free which usually leads to infinite loop).

This change fixes the above problem by incrementing global event counter before invoking umount_tree().

---
 fs/namespace.c |    1 +
 1 file changed, 1 insertion(+)

@@ -1562,6 +1562,7 @@ void __detach_mounts(struct dentry *dent
 		goto out_unlock;
 
 	lock_mount_hash();
+	event++;
 	while (!hlist_empty(&mp->m_list)) {
 		mnt = hlist_entry(mp->m_list.first, struct mount, mnt_mp_list);
 		if (mnt->mnt.mnt_flags & MNT_UMOUNT) {

Patches currently in stable-queue which might be from [email protected] are

queue-4.4/namespace-update-event-counter-when-umounting-a-deleted-dentry.patch