Unverified Commit e8c84e20 authored by Christian Brauner's avatar Christian Brauner
Browse files

statmount: don't call path_put() under namespace semaphore 



Massage statmount() and make sure we don't call path_put() under the
namespace semaphore. If we put the last reference we're fscked.

Fixes: 46eae99e ("add statmount(2) syscall")
Cc: stable@vger.kernel.org # v6.8+
Signed-off-by: default avatarChristian Brauner <brauner@kernel.org>
parent b9cb7e59

fs/namespace.c

+3 −5
Original line number Diff line number Diff line
@@ -5708,7 +5708,6 @@ static int grab_requested_root(struct mnt_namespace *ns, struct path *root) 
static int do_statmount(struct kstatmount *s, u64 mnt_id, u64 mnt_ns_id,

			struct mnt_namespace *ns)

{

	struct path root __free(path_put) = {};

	struct mount *m;

	int err;
@@ -5720,7 +5719,7 @@ static int do_statmount(struct kstatmount *s, u64 mnt_id, u64 mnt_ns_id, 
	if (!s->mnt)

		return -ENOENT;



	err = grab_requested_root(ns, &root);

	err = grab_requested_root(ns, &s->root);

	if (err)

		return err;
@@ -5729,7 +5728,7 @@ static int do_statmount(struct kstatmount *s, u64 mnt_id, u64 mnt_ns_id, 
	 * mounts to show users.

	 */

	m = real_mount(s->mnt);

	if (!is_path_reachable(m, m->mnt.mnt_root, &root) &&

	if (!is_path_reachable(m, m->mnt.mnt_root, &s->root) &&

	    !ns_capable_noaudit(ns->user_ns, CAP_SYS_ADMIN))

		return -EPERM;
@@ -5737,8 +5736,6 @@ static int do_statmount(struct kstatmount *s, u64 mnt_id, u64 mnt_ns_id, 
	if (err)

		return err;



	s->root = root;



	/*

	 * Note that mount properties in mnt->mnt_flags, mnt->mnt_idmap

	 * can change concurrently as we only hold the read-side of the
@@ -5960,6 +5957,7 @@ SYSCALL_DEFINE4(statmount, const struct mnt_id_req __user *, req, 
	if (!ret)

		ret = copy_statmount_to_user(ks);

	kvfree(ks->seq.buf);

	path_put(&ks->root);

	if (retry_statmount(ret, &seq_size))

		goto retry;

	return ret;