linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Eric Biggers <ebiggers@kernel.org>
To: linux-fsdevel@vger.kernel.org, Alexander Viro <viro@zeniv.linux.org.uk>
Cc: David Howells <dhowells@redhat.com>,
	linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com
Subject: [PATCH] vfs: move_mount: reject moving kernel internal mounts
Date: Sat, 29 Jun 2019 13:27:44 -0700	[thread overview]
Message-ID: <20190629202744.12396-1-ebiggers@kernel.org> (raw)
In-Reply-To: <CACT4Y+ZN8CZq7L1GQANr25extEqPASRERGVh+sD4-55cvWPOSg@mail.gmail.com>

From: Eric Biggers <ebiggers@google.com>

sys_move_mount() crashes by dereferencing the pointer MNT_NS_INTERNAL,
a.k.a. ERR_PTR(-EINVAL), if the old mount is specified by fd for a
kernel object with an internal mount, such as a pipe or memfd.

Fix it by checking for this case and returning -EINVAL.

Reproducer:

    #include <unistd.h>

    #define __NR_move_mount         429
    #define MOVE_MOUNT_F_EMPTY_PATH 0x00000004

    int main()
    {
    	int fds[2];

    	pipe(fds);
        syscall(__NR_move_mount, fds[0], "", -1, "/", MOVE_MOUNT_F_EMPTY_PATH);
    }

Reported-by: syzbot+6004acbaa1893ad013f0@syzkaller.appspotmail.com
Fixes: 2db154b3ea8e ("vfs: syscall: Add move_mount(2) to move mounts around")
Signed-off-by: Eric Biggers <ebiggers@google.com>
---
 fs/namespace.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/namespace.c b/fs/namespace.c
index 7660c2749c96..a7e5a44770a7 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -2600,7 +2600,7 @@ static int do_move_mount(struct path *old_path, struct path *new_path)
 	if (attached && !check_mnt(old))
 		goto out;
 
-	if (!attached && !(ns && is_anon_ns(ns)))
+	if (!attached && !(ns && ns != MNT_NS_INTERNAL && is_anon_ns(ns)))
 		goto out;
 
 	if (old->mnt.mnt_flags & MNT_LOCKED)
-- 
2.22.0


  reply	other threads:[~2019-06-29 20:30 UTC|newest]

Thread overview: 22+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-06-18 10:47 general protection fault in do_move_mount (2) syzbot
2019-06-18 14:02 ` Al Viro
2019-06-24  9:28   ` Dmitry Vyukov
2019-06-29 20:27     ` Eric Biggers [this message]
2019-06-29 20:39       ` [PATCH] vfs: move_mount: reject moving kernel internal mounts Al Viro
2019-07-01  1:08         ` Al Viro
2019-07-01 15:43           ` Eric Biggers
2019-07-01  7:38         ` David Howells
2019-07-01 11:19           ` Al Viro
2019-07-01 16:45       ` Eric Biggers
2019-07-01 18:22         ` Al Viro
2019-07-01 19:20           ` Al Viro
2019-07-02 18:22           ` Eric Biggers
2019-07-09 19:40             ` Eric Biggers
2019-07-09 20:54               ` Al Viro
2019-07-10  3:23                 ` 6 new syscalls without tests (was: [PATCH] vfs: move_mount: reject moving kernel internal mounts) Eric Biggers
2019-07-05  9:01           ` move_mount.2 David Howells
2019-06-29 20:39     ` general protection fault in do_move_mount (2) Eric Biggers
2019-07-01 14:59       ` Dmitry Vyukov
2019-07-01 15:18         ` Eric Biggers
2019-07-05 12:17           ` Dmitry Vyukov
2019-07-05 13:02           ` Dmitry Vyukov

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190629202744.12396-1-ebiggers@kernel.org \
    --to=ebiggers@kernel.org \
    --cc=dhowells@redhat.com \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=syzkaller-bugs@googlegroups.com \
    --cc=viro@zeniv.linux.org.uk \
    --subject='Re: [PATCH] vfs: move_mount: reject moving kernel internal mounts' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).