From: Al Viro <viro@zeniv.linux.org.uk>
Date: Tue, 23 Mar 2010 00:11:53 +0000 (-0400)
Subject: fix do_emergency_remount()/umount() races
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=e7fe0585ca8793e2d43c57e77d4ca79042806acf;p=GitHub%2Fmt8127%2Fandroid_kernel_alcatel_ttab.git

fix do_emergency_remount()/umount() races

need list_for_each_entry_safe() here.  Original didn't even
have restart logics, so if you race with umount() it blew up.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---

diff --git a/fs/super.c b/fs/super.c
index ccb2b5fa89bd..4df8233dfb61 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -602,10 +602,10 @@ int do_remount_sb(struct super_block *sb, int flags, void *data, int force)
 
 static void do_emergency_remount(struct work_struct *work)
 {
-	struct super_block *sb;
+	struct super_block *sb, *n;
 
 	spin_lock(&sb_lock);
-	list_for_each_entry(sb, &super_blocks, s_list) {
+	list_for_each_entry_safe(sb, n, &super_blocks, s_list) {
 		if (list_empty(&sb->s_instances))
 			continue;
 		sb->s_count++;
@@ -618,8 +618,8 @@ static void do_emergency_remount(struct work_struct *work)
 			do_remount_sb(sb, MS_RDONLY, NULL, 1);
 		}
 		up_write(&sb->s_umount);
-		put_super(sb);
 		spin_lock(&sb_lock);
+		__put_super(sb);
 	}
 	spin_unlock(&sb_lock);
 	kfree(work);