| Message ID | 20191009071850.258463-1-ebiggers@kernel.org (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | fs/namespace.c: fix use-after-free of mount in mnt_warn_timestamp_expiry() | expand |
Thanks for the fix. Would it be better to move the check and warning to a place where the access is still safe? -Deepa > On Oct 9, 2019, at 12:19 AM, Eric Biggers <ebiggers@kernel.org> wrote: > > From: Eric Biggers <ebiggers@google.com> On Wed, Oct 9, 2019 at 12:19 AM Eric Biggers <ebiggers@kernel.org> wrote: > > From: Eric Biggers <ebiggers@google.com> > > After do_add_mount() returns success, the caller doesn't hold a > reference to the 'struct mount' anymore. So it's invalid to access it > in mnt_warn_timestamp_expiry(). > > Fix it by instead passing the super_block and the mnt_flags. It's safe > to access the super_block because it's pinned by fs_context::root. > > Reported-by: syzbot+da4f525235510683d855@syzkaller.appspotmail.com > Fixes: f8b92ba67c5d ("mount: Add mount warning for impending timestamp expiry") > Signed-off-by: Eric Biggers <ebiggers@google.com> > --- > fs/namespace.c | 15 +++++++-------- > 1 file changed, 7 insertions(+), 8 deletions(-) > > diff --git a/fs/namespace.c b/fs/namespace.c > index fe0e9e1410fe..7ef8edaaed69 100644 > --- a/fs/namespace.c > +++ b/fs/namespace.c > @@ -2466,12 +2466,11 @@ static void set_mount_attributes(struct mount *mnt, unsigned int mnt_flags) > unlock_mount_hash(); > } > > -static void mnt_warn_timestamp_expiry(struct path *mountpoint, struct vfsmount *mnt) > +static void mnt_warn_timestamp_expiry(struct path *mountpoint, > + struct super_block *sb, int mnt_flags) > { > - struct super_block *sb = mnt->mnt_sb; > - > - if (!__mnt_is_readonly(mnt) && > - (ktime_get_real_seconds() + TIME_UPTIME_SEC_MAX > sb->s_time_max)) { > + if (!(mnt_flags & MNT_READONLY) && !sb_rdonly(sb) && > + (ktime_get_real_seconds() + TIME_UPTIME_SEC_MAX > sb->s_time_max)) { > char *buf = (char *)__get_free_page(GFP_KERNEL); > char *mntpath = buf ? d_path(mountpoint, buf, PAGE_SIZE) : ERR_PTR(-ENOMEM); > struct tm tm; > @@ -2512,7 +2511,7 @@ static int do_reconfigure_mnt(struct path *path, unsigned int mnt_flags) > set_mount_attributes(mnt, mnt_flags); > up_write(&sb->s_umount); > > - mnt_warn_timestamp_expiry(path, &mnt->mnt); > + mnt_warn_timestamp_expiry(path, sb, mnt_flags); > > return ret; > } > @@ -2555,7 +2554,7 @@ static int do_remount(struct path *path, int ms_flags, int sb_flags, > up_write(&sb->s_umount); > } > > - mnt_warn_timestamp_expiry(path, &mnt->mnt); > + mnt_warn_timestamp_expiry(path, sb, mnt_flags); > > put_fs_context(fc); > return err; > @@ -2770,7 +2769,7 @@ static int do_new_mount_fc(struct fs_context *fc, struct path *mountpoint, > return error; > } > > - mnt_warn_timestamp_expiry(mountpoint, mnt); > + mnt_warn_timestamp_expiry(mountpoint, sb, mnt_flags); > > return error; > } > -- > 2.23.0 >
On Sun, Oct 13, 2019 at 07:04:10PM -0700, Deepa Dinamani wrote: > Thanks for the fix. > > Would it be better to move the check and warning to a place where the > access is still safe? > > -Deepa True, we could just do diff --git a/fs/namespace.c b/fs/namespace.c index fe0e9e1410fe..9f2ceb542f05 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -2764,14 +2764,14 @@ static int do_new_mount_fc(struct fs_context *fc, struct path *mountpoint, if (IS_ERR(mnt)) return PTR_ERR(mnt); + mnt_warn_timestamp_expiry(mountpoint, mnt); + error = do_add_mount(real_mount(mnt), mountpoint, mnt_flags); if (error < 0) { mntput(mnt); return error; } - mnt_warn_timestamp_expiry(mountpoint, mnt); - return error; } But then the warning ("Mounted %s file system ...") is printed even if do_add_mount() fails so nothing was actually mounted. Though, it's just a warning message and I think failures here are rare, so maybe we don't care. Al, what do you think? - Eric
diff --git a/fs/namespace.c b/fs/namespace.c index fe0e9e1410fe..7ef8edaaed69 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -2466,12 +2466,11 @@ static void set_mount_attributes(struct mount *mnt, unsigned int mnt_flags) unlock_mount_hash(); } -static void mnt_warn_timestamp_expiry(struct path *mountpoint, struct vfsmount *mnt) +static void mnt_warn_timestamp_expiry(struct path *mountpoint, + struct super_block *sb, int mnt_flags) { - struct super_block *sb = mnt->mnt_sb; - - if (!__mnt_is_readonly(mnt) && - (ktime_get_real_seconds() + TIME_UPTIME_SEC_MAX > sb->s_time_max)) { + if (!(mnt_flags & MNT_READONLY) && !sb_rdonly(sb) && + (ktime_get_real_seconds() + TIME_UPTIME_SEC_MAX > sb->s_time_max)) { char *buf = (char *)__get_free_page(GFP_KERNEL); char *mntpath = buf ? d_path(mountpoint, buf, PAGE_SIZE) : ERR_PTR(-ENOMEM); struct tm tm; @@ -2512,7 +2511,7 @@ static int do_reconfigure_mnt(struct path *path, unsigned int mnt_flags) set_mount_attributes(mnt, mnt_flags); up_write(&sb->s_umount); - mnt_warn_timestamp_expiry(path, &mnt->mnt); + mnt_warn_timestamp_expiry(path, sb, mnt_flags); return ret; } @@ -2555,7 +2554,7 @@ static int do_remount(struct path *path, int ms_flags, int sb_flags, up_write(&sb->s_umount); } - mnt_warn_timestamp_expiry(path, &mnt->mnt); + mnt_warn_timestamp_expiry(path, sb, mnt_flags); put_fs_context(fc); return err; @@ -2770,7 +2769,7 @@ static int do_new_mount_fc(struct fs_context *fc, struct path *mountpoint, return error; } - mnt_warn_timestamp_expiry(mountpoint, mnt); + mnt_warn_timestamp_expiry(mountpoint, sb, mnt_flags); return error; }