On Mon, Apr 02, 2018 at 10:52:12PM +0100, Al Viro wrote: > On Mon, Apr 02, 2018 at 03:30:56PM -0500, Eric W. Biederman wrote: > > Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx> writes: > > > > I don't think this is a dup of existing bug. > > > We need to fix either 9ee332d99e4d5a97 or d91ee87d8d85a080. > > > > Even if expanding mount_ns to more filesystems was magically fixed, > > proc would still have this issue with the pid namespace rather than > > the net namespace. > > > > This is a mess. I will take a look and see if I can see a a fix. > > It's trivially fixable, and there's no need to modify mount_ns() at > all. > > All we need is for rpc_kill_sb() to recognize whether we are already > through the point in rpc_fill_super() where the refcount is bumped. > That's it. > > The most trivial way to do that is to move > net = get_net(sb->s_fs_info); > past > if (!root) > return -ENOMEM; > in the latter and have > out: > if (!sb->s_root) > net = NULL; > kill_litter_super(sb); > if (net) > put_net(net); > in the end of the former. And similar changes in other affected > instances. FWIW, I'm going through the ->kill_sb() instances, fixing that sort of bugs (most of them preexisting, but I should've checked instead of assuming that everything's fine). Will push out later tonight.
