From: Eric Biggers <ebiggers@kernel.org>
To: Alexander Viro <viro@zeniv.linux.org.uk>, linux-fsdevel@vger.kernel.org
Cc: Deepa Dinamani <deepa.kernel@gmail.com>,
Arnd Bergmann <arnd@arndb.de>, Jeff Layton <jlayton@kernel.org>,
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com
Subject: [PATCH] fs/namespace.c: fix use-after-free of mount in mnt_warn_timestamp_expiry()
Date: Wed, 9 Oct 2019 00:18:50 -0700 [thread overview]
Message-ID: <20191009071850.258463-1-ebiggers@kernel.org> (raw)
In-Reply-To: <000000000000805e5505945a234b@google.com>
From: Eric Biggers <ebiggers@google.com>
After do_add_mount() returns success, the caller doesn't hold a
reference to the 'struct mount' anymore. So it's invalid to access it
in mnt_warn_timestamp_expiry().
Fix it by instead passing the super_block and the mnt_flags. It's safe
to access the super_block because it's pinned by fs_context::root.
Reported-by: syzbot+da4f525235510683d855@syzkaller.appspotmail.com
Fixes: f8b92ba67c5d ("mount: Add mount warning for impending timestamp expiry")
Signed-off-by: Eric Biggers <ebiggers@google.com>
---
fs/namespace.c | 15 +++++++--------
1 file changed, 7 insertions(+), 8 deletions(-)
diff --git a/fs/namespace.c b/fs/namespace.c
index fe0e9e1410fe..7ef8edaaed69 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -2466,12 +2466,11 @@ static void set_mount_attributes(struct mount *mnt, unsigned int mnt_flags)
unlock_mount_hash();
}
-static void mnt_warn_timestamp_expiry(struct path *mountpoint, struct vfsmount *mnt)
+static void mnt_warn_timestamp_expiry(struct path *mountpoint,
+ struct super_block *sb, int mnt_flags)
{
- struct super_block *sb = mnt->mnt_sb;
-
- if (!__mnt_is_readonly(mnt) &&
- (ktime_get_real_seconds() + TIME_UPTIME_SEC_MAX > sb->s_time_max)) {
+ if (!(mnt_flags & MNT_READONLY) && !sb_rdonly(sb) &&
+ (ktime_get_real_seconds() + TIME_UPTIME_SEC_MAX > sb->s_time_max)) {
char *buf = (char *)__get_free_page(GFP_KERNEL);
char *mntpath = buf ? d_path(mountpoint, buf, PAGE_SIZE) : ERR_PTR(-ENOMEM);
struct tm tm;
@@ -2512,7 +2511,7 @@ static int do_reconfigure_mnt(struct path *path, unsigned int mnt_flags)
set_mount_attributes(mnt, mnt_flags);
up_write(&sb->s_umount);
- mnt_warn_timestamp_expiry(path, &mnt->mnt);
+ mnt_warn_timestamp_expiry(path, sb, mnt_flags);
return ret;
}
@@ -2555,7 +2554,7 @@ static int do_remount(struct path *path, int ms_flags, int sb_flags,
up_write(&sb->s_umount);
}
- mnt_warn_timestamp_expiry(path, &mnt->mnt);
+ mnt_warn_timestamp_expiry(path, sb, mnt_flags);
put_fs_context(fc);
return err;
@@ -2770,7 +2769,7 @@ static int do_new_mount_fc(struct fs_context *fc, struct path *mountpoint,
return error;
}
- mnt_warn_timestamp_expiry(mountpoint, mnt);
+ mnt_warn_timestamp_expiry(mountpoint, sb, mnt_flags);
return error;
}
--
2.23.0
next prev parent reply other threads:[~2019-10-09 7:19 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-07 23:09 KASAN: use-after-free Read in do_mount syzbot
2019-10-09 7:18 ` Eric Biggers [this message]
2019-10-14 2:04 ` [PATCH] fs/namespace.c: fix use-after-free of mount in mnt_warn_timestamp_expiry() Deepa Dinamani
2019-10-14 3:22 ` Eric Biggers
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191009071850.258463-1-ebiggers@kernel.org \
--to=ebiggers@kernel.org \
--cc=arnd@arndb.de \
--cc=deepa.kernel@gmail.com \
--cc=jlayton@kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).