Messages in this thread | | | From | Dmitry Vyukov <> | Date | Tue, 19 Dec 2017 17:31:48 +0100 | Subject | Re: [PATCH linux-next] mqueue: fix IPC namespace use-after-free |
| |
On Tue, Dec 19, 2017 at 4:44 PM, Al Viro <viro@zeniv.linux.org.uk> wrote: > On Tue, Dec 19, 2017 at 03:32:25PM +0000, Al Viro wrote: >> + m = mq_internal_mount(); >> + if (IS_ERR(m)) >> + return ERR_CAST(m); >> + atomic_inc(&m->mnt_sb->s_active); >> + down_write(&m->mnt_sb->s_umount); >> + return dget(m->mnt_root); > > Note: this is stripped down mount_subtree(m, ""), of course; > it might make sense to recognize that case and bypass the > create_mnt_ns/vfs_path_lookup/put_mnt_ns business in > mount_subtree() when the relative pathname is empty, replacing > it with path.mnt = mntget(mnt); path.dentry = dget(mnt->mnt_root); > in such case. That'd allow to simply call mount_subtree() here. > It would work as-is, but it's ridiculously heavy for such use > right now. > >> static int __init init_mqueue_fs(void) >> { >> + struct vfsmount *m; >> int error; >> >> mqueue_inode_cachep = kmem_cache_create("mqueue_inode_cache", >> @@ -1577,6 +1606,10 @@ static int __init init_mqueue_fs(void) >> if (error) >> goto out_filesystem; >> >> + m = kern_mount_data(&mqueue_fs_type, &init_ipc_ns); >> + if (IS_ERR(m)) >> + goto out_filesystem; >> + init_ipc_ns.mq_mnt = m; >> return 0; >> >> out_filesystem: > > Unrelated issue, but register_filesystem() should be the last thing > module_init() of a filesystem driver does. It's a separate story, > in any case...
Giuseppe, what report is this? If there is a reproducer, you can ask syzbot to test a patch.
| |