fs/namespace.c: fix use-after-free of mount in mnt_warn_timestamp_expiry()
diff mbox series

Message ID 20191009071850.258463-1-ebiggers@kernel.org
State New
Headers show
Series
  • fs/namespace.c: fix use-after-free of mount in mnt_warn_timestamp_expiry()
Related show

Commit Message

Eric Biggers Oct. 9, 2019, 7:18 a.m. UTC
From: Eric Biggers <ebiggers@google.com>

After do_add_mount() returns success, the caller doesn't hold a
reference to the 'struct mount' anymore.  So it's invalid to access it
in mnt_warn_timestamp_expiry().

Fix it by instead passing the super_block and the mnt_flags.  It's safe
to access the super_block because it's pinned by fs_context::root.

Reported-by: syzbot+da4f525235510683d855@syzkaller.appspotmail.com
Fixes: f8b92ba67c5d ("mount: Add mount warning for impending timestamp expiry")
Signed-off-by: Eric Biggers <ebiggers@google.com>
---
 fs/namespace.c | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

Comments

Deepa Dinamani Oct. 14, 2019, 2:04 a.m. UTC | #1
Thanks for the fix.

Would it be better to move the check and warning to a place where the
access is still safe?

-Deepa

> On Oct 9, 2019, at 12:19 AM, Eric Biggers <ebiggers@kernel.org> wrote:
>
> ´╗┐From: Eric Biggers <ebiggers@google.com>


On Wed, Oct 9, 2019 at 12:19 AM Eric Biggers <ebiggers@kernel.org> wrote:
>
> From: Eric Biggers <ebiggers@google.com>
>
> After do_add_mount() returns success, the caller doesn't hold a
> reference to the 'struct mount' anymore.  So it's invalid to access it
> in mnt_warn_timestamp_expiry().
>
> Fix it by instead passing the super_block and the mnt_flags.  It's safe
> to access the super_block because it's pinned by fs_context::root.
>
> Reported-by: syzbot+da4f525235510683d855@syzkaller.appspotmail.com
> Fixes: f8b92ba67c5d ("mount: Add mount warning for impending timestamp expiry")
> Signed-off-by: Eric Biggers <ebiggers@google.com>
> ---
>  fs/namespace.c | 15 +++++++--------
>  1 file changed, 7 insertions(+), 8 deletions(-)
>
> diff --git a/fs/namespace.c b/fs/namespace.c
> index fe0e9e1410fe..7ef8edaaed69 100644
> --- a/fs/namespace.c
> +++ b/fs/namespace.c
> @@ -2466,12 +2466,11 @@ static void set_mount_attributes(struct mount *mnt, unsigned int mnt_flags)
>         unlock_mount_hash();
>  }
>
> -static void mnt_warn_timestamp_expiry(struct path *mountpoint, struct vfsmount *mnt)
> +static void mnt_warn_timestamp_expiry(struct path *mountpoint,
> +                                     struct super_block *sb, int mnt_flags)
>  {
> -       struct super_block *sb = mnt->mnt_sb;
> -
> -       if (!__mnt_is_readonly(mnt) &&
> -          (ktime_get_real_seconds() + TIME_UPTIME_SEC_MAX > sb->s_time_max)) {
> +       if (!(mnt_flags & MNT_READONLY) && !sb_rdonly(sb) &&
> +           (ktime_get_real_seconds() + TIME_UPTIME_SEC_MAX > sb->s_time_max)) {
>                 char *buf = (char *)__get_free_page(GFP_KERNEL);
>                 char *mntpath = buf ? d_path(mountpoint, buf, PAGE_SIZE) : ERR_PTR(-ENOMEM);
>                 struct tm tm;
> @@ -2512,7 +2511,7 @@ static int do_reconfigure_mnt(struct path *path, unsigned int mnt_flags)
>                 set_mount_attributes(mnt, mnt_flags);
>         up_write(&sb->s_umount);
>
> -       mnt_warn_timestamp_expiry(path, &mnt->mnt);
> +       mnt_warn_timestamp_expiry(path, sb, mnt_flags);
>
>         return ret;
>  }
> @@ -2555,7 +2554,7 @@ static int do_remount(struct path *path, int ms_flags, int sb_flags,
>                 up_write(&sb->s_umount);
>         }
>
> -       mnt_warn_timestamp_expiry(path, &mnt->mnt);
> +       mnt_warn_timestamp_expiry(path, sb, mnt_flags);
>
>         put_fs_context(fc);
>         return err;
> @@ -2770,7 +2769,7 @@ static int do_new_mount_fc(struct fs_context *fc, struct path *mountpoint,
>                 return error;
>         }
>
> -       mnt_warn_timestamp_expiry(mountpoint, mnt);
> +       mnt_warn_timestamp_expiry(mountpoint, sb, mnt_flags);
>
>         return error;
>  }
> --
> 2.23.0
>
Eric Biggers Oct. 14, 2019, 3:22 a.m. UTC | #2
On Sun, Oct 13, 2019 at 07:04:10PM -0700, Deepa Dinamani wrote:
> Thanks for the fix.
> 
> Would it be better to move the check and warning to a place where the
> access is still safe?
> 
> -Deepa

True, we could just do

diff --git a/fs/namespace.c b/fs/namespace.c
index fe0e9e1410fe..9f2ceb542f05 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -2764,14 +2764,14 @@ static int do_new_mount_fc(struct fs_context *fc, struct path *mountpoint,
 	if (IS_ERR(mnt))
 		return PTR_ERR(mnt);
 
+	mnt_warn_timestamp_expiry(mountpoint, mnt);
+
 	error = do_add_mount(real_mount(mnt), mountpoint, mnt_flags);
 	if (error < 0) {
 		mntput(mnt);
 		return error;
 	}
 
-	mnt_warn_timestamp_expiry(mountpoint, mnt);
-
 	return error;
 }

But then the warning ("Mounted %s file system ...") is printed even if
do_add_mount() fails so nothing was actually mounted.

Though, it's just a warning message and I think failures here are rare, so maybe
we don't care.  Al, what do you think?

- Eric

Patch
diff mbox series

diff --git a/fs/namespace.c b/fs/namespace.c
index fe0e9e1410fe..7ef8edaaed69 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -2466,12 +2466,11 @@  static void set_mount_attributes(struct mount *mnt, unsigned int mnt_flags)
 	unlock_mount_hash();
 }
 
-static void mnt_warn_timestamp_expiry(struct path *mountpoint, struct vfsmount *mnt)
+static void mnt_warn_timestamp_expiry(struct path *mountpoint,
+				      struct super_block *sb, int mnt_flags)
 {
-	struct super_block *sb = mnt->mnt_sb;
-
-	if (!__mnt_is_readonly(mnt) &&
-	   (ktime_get_real_seconds() + TIME_UPTIME_SEC_MAX > sb->s_time_max)) {
+	if (!(mnt_flags & MNT_READONLY) && !sb_rdonly(sb) &&
+	    (ktime_get_real_seconds() + TIME_UPTIME_SEC_MAX > sb->s_time_max)) {
 		char *buf = (char *)__get_free_page(GFP_KERNEL);
 		char *mntpath = buf ? d_path(mountpoint, buf, PAGE_SIZE) : ERR_PTR(-ENOMEM);
 		struct tm tm;
@@ -2512,7 +2511,7 @@  static int do_reconfigure_mnt(struct path *path, unsigned int mnt_flags)
 		set_mount_attributes(mnt, mnt_flags);
 	up_write(&sb->s_umount);
 
-	mnt_warn_timestamp_expiry(path, &mnt->mnt);
+	mnt_warn_timestamp_expiry(path, sb, mnt_flags);
 
 	return ret;
 }
@@ -2555,7 +2554,7 @@  static int do_remount(struct path *path, int ms_flags, int sb_flags,
 		up_write(&sb->s_umount);
 	}
 
-	mnt_warn_timestamp_expiry(path, &mnt->mnt);
+	mnt_warn_timestamp_expiry(path, sb, mnt_flags);
 
 	put_fs_context(fc);
 	return err;
@@ -2770,7 +2769,7 @@  static int do_new_mount_fc(struct fs_context *fc, struct path *mountpoint,
 		return error;
 	}
 
-	mnt_warn_timestamp_expiry(mountpoint, mnt);
+	mnt_warn_timestamp_expiry(mountpoint, sb, mnt_flags);
 
 	return error;
 }