On Thu, Feb 15, 2018 at 06:39:57PM +0000, Al Viro wrote: > Not true. We also assume that once fs_struct has been locked, the number of > tasks with reference to it won't change. See fs/exec.c:check_unsafe_exec(), > for example.
PS: any discussion of VFS and filesystems stuff belongs on fsdevel; Cc to l-k is fine, but don't expect anyone to be able to reliably spot it there. l-k is far too high volume (and low S/N) to keep up with it; some of us have entirely given up on it (Linus is certainly not the only one who'd unsubscribed from l-k many years ago), some try to scan it for something relevant, but latency and reliability of such scans inevitably sucks.
