* [PATCH v2] fs/namespace.c: fix use-after-free of mount in mnt_warn_timestamp_expiry()
@ 2019-10-17 2:48 Eric Biggers
2019-10-17 3:15 ` Al Viro
0 siblings, 1 reply; 2+ messages in thread
From: Eric Biggers @ 2019-10-17 2:48 UTC (permalink / raw)
To: Alexander Viro, linux-fsdevel; +Cc: Deepa Dinamani, Arnd Bergmann, Jeff Layton
From: Eric Biggers <ebiggers@google.com>
After do_add_mount() returns success, the caller doesn't hold a
reference to the 'struct mount' anymore. So it's invalid to access it
in mnt_warn_timestamp_expiry().
Fix it by calling mnt_warn_timestamp_expiry() before do_add_mount()
rather than after, and adjusting the warning message accordingly.
Reported-by: syzbot+da4f525235510683d855@syzkaller.appspotmail.com
Fixes: f8b92ba67c5d ("mount: Add mount warning for impending timestamp expiry")
Signed-off-by: Eric Biggers <ebiggers@google.com>
---
fs/namespace.c | 15 +++++++--------
1 file changed, 7 insertions(+), 8 deletions(-)
diff --git a/fs/namespace.c b/fs/namespace.c
index fe0e9e1410fe..2adfe7b166a3 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -2478,8 +2478,10 @@ static void mnt_warn_timestamp_expiry(struct path *mountpoint, struct vfsmount *
time64_to_tm(sb->s_time_max, 0, &tm);
- pr_warn("Mounted %s file system at %s supports timestamps until %04ld (0x%llx)\n",
- sb->s_type->name, mntpath,
+ pr_warn("%s filesystem being %s at %s supports timestamps until %04ld (0x%llx)\n",
+ sb->s_type->name,
+ is_mounted(mnt) ? "remounted" : "mounted",
+ mntpath,
tm.tm_year+1900, (unsigned long long)sb->s_time_max);
free_page((unsigned long)buf);
@@ -2764,14 +2766,11 @@ static int do_new_mount_fc(struct fs_context *fc, struct path *mountpoint,
if (IS_ERR(mnt))
return PTR_ERR(mnt);
- error = do_add_mount(real_mount(mnt), mountpoint, mnt_flags);
- if (error < 0) {
- mntput(mnt);
- return error;
- }
-
mnt_warn_timestamp_expiry(mountpoint, mnt);
+ error = do_add_mount(real_mount(mnt), mountpoint, mnt_flags);
+ if (error < 0)
+ mntput(mnt);
return error;
}
--
2.23.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH v2] fs/namespace.c: fix use-after-free of mount in mnt_warn_timestamp_expiry()
2019-10-17 2:48 [PATCH v2] fs/namespace.c: fix use-after-free of mount in mnt_warn_timestamp_expiry() Eric Biggers
@ 2019-10-17 3:15 ` Al Viro
0 siblings, 0 replies; 2+ messages in thread
From: Al Viro @ 2019-10-17 3:15 UTC (permalink / raw)
To: Eric Biggers; +Cc: linux-fsdevel, Deepa Dinamani, Arnd Bergmann, Jeff Layton
On Wed, Oct 16, 2019 at 07:48:14PM -0700, Eric Biggers wrote:
> From: Eric Biggers <ebiggers@google.com>
>
> After do_add_mount() returns success, the caller doesn't hold a
> reference to the 'struct mount' anymore. So it's invalid to access it
> in mnt_warn_timestamp_expiry().
>
> Fix it by calling mnt_warn_timestamp_expiry() before do_add_mount()
> rather than after, and adjusting the warning message accordingly.
>
> Reported-by: syzbot+da4f525235510683d855@syzkaller.appspotmail.com
> Fixes: f8b92ba67c5d ("mount: Add mount warning for impending timestamp expiry")
> Signed-off-by: Eric Biggers <ebiggers@google.com>
Applied to #fixes and pushed
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-10-17 3:15 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-10-17 2:48 [PATCH v2] fs/namespace.c: fix use-after-free of mount in mnt_warn_timestamp_expiry() Eric Biggers
2019-10-17 3:15 ` Al Viro
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).