[PATCH] namespace.c: fix mnt_namespace clearing

[PATCH] namespace.c: fix mnt_namespace clearing

[Miklos Szeredi]

This patch clears mnt_namespace on unmount.

Not clearing mnt_namespace has two effects:

   1) It is possible to attach a new mount to a detached mount,
      because check_mnt() returns true.

      This means, that when no other references to the detached mount
      remain, it still can't be freed.  This causes a resource leak,
      and possibly un-removable modules.

   2) If mnt_namespace is dereferenced (only in mark_mounts_for_expiry())
      after the namspace has been freed, it can cause an Oops, memory
      corruption, etc.

1) has been tested before and after the patch, 2) is only speculation.

Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>

Index: linux/fs/namespace.c
===================================================================
--- linux.orig/fs/namespace.c	2005-05-16 21:02:54.000000000 +0200
+++ linux/fs/namespace.c	2005-05-16 21:20:10.000000000 +0200
@@ -345,6 +345,7 @@ static void umount_tree(struct vfsmount 
 	for (p = mnt; p; p = next_mnt(p, mnt)) {
 		list_del(&p->mnt_list);
 		list_add(&p->mnt_list, &kill);
+		p->mnt_namespace = NULL;
 	}
 
 	while (!list_empty(&kill)) {
@@ -1449,15 +1450,8 @@ void __init mnt_init(unsigned long mempa
 
 void __put_namespace(struct namespace *namespace)
 {
-	struct vfsmount *mnt;
-
 	down_write(&namespace->sem);
 	spin_lock(&vfsmount_lock);
-
-	list_for_each_entry(mnt, &namespace->list, mnt_list) {
-		mnt->mnt_namespace = NULL;
-	}
-
 	umount_tree(namespace->root);
 	spin_unlock(&vfsmount_lock);
 	up_write(&namespace->sem);

Re: [PATCH] namespace.c: fix mnt_namespace clearing

[Jamie Lokier]

Miklos Szeredi wrote:
> This patch clears mnt_namespace on unmount.
> 
> Not clearing mnt_namespace has two effects:
> 
>    1) It is possible to attach a new mount to a detached mount,
>       because check_mnt() returns true.
> 
>       This means, that when no other references to the detached mount
>       remain, it still can't be freed.  This causes a resource leak,
>       and possibly un-removable modules.
> 
>    2) If mnt_namespace is dereferenced (only in mark_mounts_for_expiry())
>       after the namspace has been freed, it can cause an Oops, memory
>       corruption, etc.
> 
> 1) has been tested before and after the patch, 2) is only speculation.

You're right - I was just thinking the same thing.  There is also
another side effect, which is ironic in the context of recent discussion:

     3) Because mnt_namespace may refer to freed memory, it may refer
        to memory that's then allocated for _another_ namespace.  So the
        check for mounting in the correct namespace which prevents
	recursive bind mounts could erronously _allow_ the recursive
	bind to succeed (though without taking the correct lock).

-- Jamie