lkml.org 
[lkml]   [2026]   [Jun]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()
On Wed, Jun 03, 2026 at 07:41:51PM +0100, Al Viro wrote:

> Basically, the store that cleared ->mnt_ns has been done in namespace_sem
> scope and that scope is either no later than the scope in put_mnt_ns()

argh... s/either//

> that has dropped the active refcount of ns to zero. At the beginning
> of that scope in put_mnt_ns() we are guaranteed to have the passive
> refcount positive. Dropping the passive reference happens after an
> rcu delay started in later in the same namespace_sem scope and namespace
> is not freed until the passive refcount reaches zero.

TL;DR: your fix is correct, but needs a better explanation of correctness.
If nothing else, I'd like to have the above findable on lore - I've way
too many pieces of half-baked docs sitting around in local notes as it is ;-/

\
 
 \ /
  Last update: 2026-06-03 20:59    [W:0.081 / U:3.188 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and my Meterkast|Read the blog