From: Eric Biggers <ebiggers3@gmail.com>
To: David Howells <dhowells@redhat.com>,
Alexander Viro <viro@zeniv.linux.org.uk>,
linux-fsdevel@vger.kernel.org
Cc: linux-kernel@vger.kernel.org, Eric Biggers <ebiggers@google.com>
Subject: [PATCH 10/18] fsmount: fix bypassing SB_MANDLOCK permission check
Date: Sun, 8 Jul 2018 14:01:46 -0700 [thread overview]
Message-ID: <20180708210154.10423-11-ebiggers3@gmail.com> (raw)
In-Reply-To: <20180708210154.10423-1-ebiggers3@gmail.com>
From: Eric Biggers <ebiggers@google.com>
fc->sb_flags can be modified up until fc->uapi_mutex is taken, so the
permission check for SB_MANDLOCK needs to happen under the mutex.
Also move the may_mount() check as early as possible.
Fixes: 0c65353ab9f5 ("vfs: Implement fsmount() to effect a pre-configured mount")
Signed-off-by: Eric Biggers <ebiggers@google.com>
---
fs/namespace.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/fs/namespace.c b/fs/namespace.c
index 8ac9e8fb31c9f..7f0191bb5db46 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -3237,6 +3237,9 @@ SYSCALL_DEFINE3(fsmount, int, fs_fd, unsigned int, flags, unsigned int, ms_flags
unsigned int mnt_flags = 0;
long ret;
+ if (!may_mount())
+ return -EPERM;
+
if ((flags & ~(FSMOUNT_CLOEXEC)) != 0)
return -EINVAL;
@@ -3275,11 +3278,6 @@ SYSCALL_DEFINE3(fsmount, int, fs_fd, unsigned int, flags, unsigned int, ms_flags
fc = f.file->private_data;
- ret = -EPERM;
- if (!may_mount() ||
- ((fc->sb_flags & SB_MANDLOCK) && !may_mandlock()))
- goto err_fsfd;
-
/* There must be a valid superblock or we can't mount it */
ret = -EINVAL;
if (!fc->root)
@@ -3300,6 +3298,10 @@ SYSCALL_DEFINE3(fsmount, int, fs_fd, unsigned int, flags, unsigned int, ms_flags
if (fc->phase != FS_CONTEXT_AWAITING_MOUNT)
goto err_unlock;
+ ret = -EPERM;
+ if ((fc->sb_flags & SB_MANDLOCK) && !may_mandlock())
+ goto err_unlock;
+
newmount.mnt = vfs_create_mount(fc, mnt_flags);
if (IS_ERR(newmount.mnt)) {
ret = PTR_ERR(newmount.mnt);
--
2.18.0
next prev parent reply other threads:[~2018-07-08 21:05 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-07-08 21:01 [PATCH vfs/for-next 00/18] fs_context fixes Eric Biggers
2018-07-08 21:01 ` [PATCH 01/18] sysfs: check return value of kernfs_get_tree() Eric Biggers
2018-07-08 21:01 ` [PATCH 02/18] fs_context: fix shrinker leak in sget_fc() Eric Biggers
2018-07-08 21:01 ` [PATCH 03/18] fs_context: fix detecting full log buffer Eric Biggers
2018-07-08 21:01 ` [PATCH 04/18] fs_context: fix fs_context leak in simple_pin_fs() Eric Biggers
2018-07-08 21:01 ` [PATCH 05/18] fs_context: fix mount option blacklist Eric Biggers
2018-07-08 21:01 ` [PATCH 06/18] fs_context: fix memory leak with 's' (source) command Eric Biggers
2018-07-08 21:01 ` [PATCH 07/18] fs_context: fix double free of legacy_fs_context data Eric Biggers
2018-07-08 21:01 ` [PATCH 08/18] fsmount: pass up error code from dentry_open() Eric Biggers
2018-07-08 21:01 ` [PATCH 09/18] fsmount: fix handling FSMOUNT_CLOEXEC Eric Biggers
2018-07-08 21:01 ` Eric Biggers [this message]
2018-07-08 21:01 ` [PATCH 11/18] fspick: fix path leak Eric Biggers
2018-07-08 21:01 ` [PATCH 12/18] fspick: add missing permission check Eric Biggers
2018-07-08 21:01 ` [PATCH 13/18] fsmount: removed unused variable 'inode' Eric Biggers
2018-07-08 21:01 ` [PATCH 14/18] fsopen,fspick: factor out log allocation Eric Biggers
2018-07-08 21:01 ` [PATCH 15/18] fsopen,fspick: rename fsopen_create_fd() to fscontext_create_fd() Eric Biggers
2018-07-08 21:01 ` [PATCH 16/18] fs_context: de-obfuscate control flow in fscontext_read() Eric Biggers
2018-07-08 21:01 ` [PATCH 17/18] fs_context: de-obfuscate command validation Eric Biggers
2018-07-08 21:01 ` [PATCH 18/18] fs_context: fix fscontext_write() comment Eric Biggers
2018-07-08 23:46 ` [PATCH vfs/for-next 00/18] fs_context fixes Eric Biggers
2018-07-09 9:32 ` [PATCH 03/18] fs_context: fix detecting full log buffer David Howells
2018-07-09 9:35 ` David Howells
2018-07-09 12:31 ` [PATCH 07/18] fs_context: fix double free of legacy_fs_context data David Howells
2018-07-10 1:17 ` Eric Biggers
2018-07-10 1:25 ` Eric Biggers
2018-07-10 8:02 ` David Howells
2018-07-09 15:31 ` [PATCH vfs/for-next 00/18] fs_context fixes David Howells
2018-07-09 15:56 ` Al Viro
2018-07-09 16:28 ` David Howells
2018-07-09 21:57 ` David Howells
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180708210154.10423-11-ebiggers3@gmail.com \
--to=ebiggers3@gmail.com \
--cc=dhowells@redhat.com \
--cc=ebiggers@google.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).