[PATCH] fhandle: reject detached mounts in capable_wrt_mount()

[PATCH] fhandle: reject detached mounts in capable_wrt_mount()

[David Lee]

The recent fhandle RCU fix moved the mount namespace capability check
into capable_wrt_mount(), so a non-NULL mnt_namespace survives the
ns_capable() dereference. The helper still assumes the later
READ_ONCE(mount->mnt_ns) must be non-NULL because may_decode_fh()
checked is_mounted() first.

That assumption is not stable. A detached mount from
open_tree(..., OPEN_TREE_CLONE) can be dissolved on fput while
open_by_handle_at() is between those checks, and umount_tree() can
clear mount->mnt_ns. If the helper observes NULL, it dereferences
mnt_ns->user_ns and panics.

Return false when the RCU read observes a detached mount. This keeps
the relaxed permission path conservative: a mount no longer attached
to a namespace cannot authorize open_by_handle_at() access.

Fixes: 620c266f3949 ("fhandle: relax open_by_handle_at() permission checks")
Cc: stable@vger.kernel.org
Signed-off-by: David Lee <david.lee@trailofbits.com>
Assisted-by: Codex:gpt-5
---
Bug found and triaged by David Lee from Trail of Bits.

Trail of Bits has a minimal PoC that triggers this crash on a custom
kernel build, which can be shared further if needed.

 fs/fhandle.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/fhandle.c b/fs/fhandle.c
index 1ca7eb3a6cb5..f8829231e3d7 100644
--- a/fs/fhandle.c
+++ b/fs/fhandle.c
@@ -295,7 +295,7 @@ static bool capable_wrt_mount(struct mount *mount)
 	 */
 	guard(rcu)();
 	mnt_ns = READ_ONCE(mount->mnt_ns);
-	return ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN);
+	return mnt_ns && ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN);
 }
 
 static inline int may_decode_fh(struct handle_to_path_ctx *ctx,
-- 
2.43.0

Re: [PATCH] fhandle: reject detached mounts in capable_wrt_mount()

[Jeff Layton]

On Wed, 2026-07-01 at 11:44 +0000, David Lee wrote:
> The recent fhandle RCU fix moved the mount namespace capability check
> into capable_wrt_mount(), so a non-NULL mnt_namespace survives the
> ns_capable() dereference. The helper still assumes the later
> READ_ONCE(mount->mnt_ns) must be non-NULL because may_decode_fh()
> checked is_mounted() first.
> 
> That assumption is not stable. A detached mount from
> open_tree(..., OPEN_TREE_CLONE) can be dissolved on fput while
> open_by_handle_at() is between those checks, and umount_tree() can
> clear mount->mnt_ns. If the helper observes NULL, it dereferences
> mnt_ns->user_ns and panics.
> 
> Return false when the RCU read observes a detached mount. This keeps
> the relaxed permission path conservative: a mount no longer attached
> to a namespace cannot authorize open_by_handle_at() access.
> 
> Fixes: 620c266f3949 ("fhandle: relax open_by_handle_at() permission checks")
> Cc: stable@vger.kernel.org
> Signed-off-by: David Lee <david.lee@trailofbits.com>
> Assisted-by: Codex:gpt-5
> ---
> Bug found and triaged by David Lee from Trail of Bits.
> 
> Trail of Bits has a minimal PoC that triggers this crash on a custom
> kernel build, which can be shared further if needed.
> 
>  fs/fhandle.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/fhandle.c b/fs/fhandle.c
> index 1ca7eb3a6cb5..f8829231e3d7 100644
> --- a/fs/fhandle.c
> +++ b/fs/fhandle.c
> @@ -295,7 +295,7 @@ static bool capable_wrt_mount(struct mount *mount)
>  	 */
>  	guard(rcu)();
>  	mnt_ns = READ_ONCE(mount->mnt_ns);
> -	return ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN);
> +	return mnt_ns && ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN);
>  }
>  
>  static inline int may_decode_fh(struct handle_to_path_ctx *ctx,

Seems sane.

Reviewed-by: Jeff Layton <jlayton@kernel.org>

Re: [PATCH] fhandle: reject detached mounts in capable_wrt_mount()

[Christian Brauner]

On Wed, 01 Jul 2026 11:44:28 +0000, David Lee wrote:
> fhandle: reject detached mounts in capable_wrt_mount()

Applied to the vfs.fixes branch of the vfs/vfs.git tree.
Patches in the vfs.fixes branch should appear in linux-next soon.

Please report any outstanding bugs that were missed during review in a
new review to the original patch series allowing us to drop it.

It's encouraged to provide Acked-bys and Reviewed-bys even though the
patch has now been applied. If possible patch trailers will be updated.

Note that commit hashes shown below are subject to change due to rebase,
trailer updates or similar. If in doubt, please check the listed branch.

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git
branch: vfs.fixes

[1/1] fhandle: reject detached mounts in capable_wrt_mount()
      https://git.kernel.org/vfs/vfs/c/b2f046af8c6c