From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mailhub.sw.ru ([195.214.232.25]:38979 "EHLO relay.sw.ru" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932688AbcCOMLQ (ORCPT ); Tue, 15 Mar 2016 08:11:16 -0400 From: Pavel Tikhomirov To: Seth Forshee , "Eric W. Biederman" , Cc: Serge Hallyn , Alexander Viro , Jeff Layton , "J. Bruce Fields" , Andy Lutomirski , linux-security-module@vger.kernel.org, linux-mtd@lists.infradead.org, selinux@tycho.nsa.gov, linux-fsdevel@vger.kernel.org, Pavel Tikhomirov , Konstantin Khorenko , Pavel Emelyanov Subject: [PATCH] fs: fix a posible leak of allocated superblock Date: Tue, 15 Mar 2016 15:08:50 +0300 Message-Id: <1458043730-14296-1-git-send-email-ptikhomirov@virtuozzo.com> In-Reply-To: <1443039368-55445-2-git-send-email-seth.forshee@canonical.com> References: <1443039368-55445-2-git-send-email-seth.forshee@canonical.com> Sender: linux-fsdevel-owner@vger.kernel.org List-ID: We probably need to fix superblock leak in patch (v4 "fs: Add user namesapace member to struct super_block"): Imagine posible code path in sget_userns: we iterate through type->fs_supers and do not find suitable sb, we drop sb_lock to allocate s and go to retry. After we dropped sb_lock some other task from different userns takes sb_lock, it is already in retry stage and has s allocated, so it puts its s in type->fs_supers list. So in retry we will find these sb in list and check it has a different userns, and finally we will return without freeing s. Signed-off-by: Pavel Tikhomirov --- fs/super.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/super.c b/fs/super.c index b4ee02b..24771b5 100644 --- a/fs/super.c +++ b/fs/super.c @@ -458,6 +458,10 @@ struct super_block *sget_userns(struct file_system_type *type, continue; if (user_ns != old->s_user_ns) { spin_unlock(&sb_lock); + if (s) { + up_write(&s->s_umount); + destroy_super(s); + } return ERR_PTR(-EBUSY); } if (!grab_super(old)) -- 1.9.3