From: Al Viro <viro@zeniv.linux.org.uk>
To: Christian Brauner <brauner@kernel.org>
Cc: linux-fsdevel@vger.kernel.org,
Linus Torvalds <torvalds@linux-foundation.org>
Subject: reproducer for "do_move_mount(): don't leak MNTNS_PROPAGATING on failures"
Date: Thu, 8 May 2025 21:03:32 +0100 [thread overview]
Message-ID: <20250508200332.GH2023217@ZenIV> (raw)
In-Reply-To: <20250508200211.GF2023217@ZenIV>
#include <string.h>
#include <unistd.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <stdio.h>
static int tmpfs(const char *name)
{
return mount("none", name, "tmpfs", 0, NULL);
}
static int change(const char *name, int how)
{
return mount(NULL, name, NULL, how, NULL);
}
static int bind(const char *from, const char *to)
{
return mount(from, to, NULL, MS_BIND, NULL);
}
static _Bool exists(const char *name)
{
return access(name, F_OK) != -1;
}
void playground(void)
{
mkdir("/tmp/foo", 0700);
tmpfs("/tmp/foo");
change("/tmp/foo", MS_PRIVATE);
chdir("/tmp/foo");
}
void cleanup(int fd)
{
close(fd);
chdir("/tmp");
umount2("/tmp/foo", MNT_DETACH);
rmdir("/tmp/foo");
}
main()
{
playground();
mkdir("A", 0700);
mkdir("A/subdir", 0700);
mkdir("B", 0700);
bind("A", "A");
change("A", MS_SHARED);
int fd = open_tree(AT_FDCWD, "A", OPEN_TREE_CLONE);
// this move_mount should fail (directory on top of non-directory)
if (move_mount(fd, "", AT_FDCWD, "/dev/null", MOVE_MOUNT_F_EMPTY_PATH) == 0) {
printf("unexpected success of first move_mount()\n");
cleanup(fd);
return -1;
}
// this should propagate into detached tree
tmpfs("A/subdir");
mkdir("A/subdir/foo", 0700);
// move detached tree in, so we could check it
if (move_mount(fd, "", AT_FDCWD, "B", MOVE_MOUNT_F_EMPTY_PATH) != 0) {
printf("unexpected failure of the second move_mount()\n");
cleanup(fd);
}
if (!exists("B/subdir/foo")) {
printf("failed to propagate into detached tree\n");
cleanup(fd);
return -1;
}
printf("success\n");
cleanup(fd);
return 0;
}
next prev parent reply other threads:[~2025-05-08 20:03 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-04-28 6:30 [RFC] move_mount(2): still breakage around new mount detection Al Viro
2025-04-28 7:03 ` Al Viro
2025-04-28 8:50 ` Christian Brauner
2025-04-28 18:53 ` Al Viro
2025-04-29 4:03 ` Al Viro
2025-04-29 5:10 ` Al Viro
2025-04-29 5:27 ` Al Viro
2025-04-29 8:21 ` Christian Brauner
2025-05-05 5:08 ` Al Viro
2025-05-05 14:20 ` Christian Brauner
2025-04-29 7:56 ` Christian Brauner
2025-04-29 12:27 ` Al Viro
2025-04-29 7:52 ` Christian Brauner
2025-05-08 5:56 ` more breakage there (was Re: [RFC] move_mount(2): still breakage around new mount detection) Al Viro
2025-05-08 19:59 ` Al Viro
2025-05-08 20:00 ` [PATCH 1/4] __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock Al Viro
2025-05-09 11:02 ` Christian Brauner
2025-05-08 20:01 ` [PATCH 2/4] do_umount(): add missing barrier before refcount checks in sync case Al Viro
2025-05-09 11:02 ` Christian Brauner
2025-05-08 20:02 ` [PATCH 3/4] do_move_mount(): don't leak MNTNS_PROPAGATING on failures Al Viro
2025-05-08 20:03 ` Al Viro [this message]
2025-05-09 11:02 ` Christian Brauner
2025-05-13 11:03 ` Lai, Yi
2025-05-13 12:08 ` Al Viro
2025-05-13 14:33 ` Lai, Yi
2025-05-08 20:02 ` [PATCH 4/4] fix IS_MNT_PROPAGATING uses Al Viro
2025-05-08 20:04 ` reproducer for "fix IS_MNT_PROPAGATING uses" Al Viro
2025-05-09 11:01 ` [PATCH 4/4] fix IS_MNT_PROPAGATING uses Christian Brauner
2025-05-09 11:06 ` more breakage there (was Re: [RFC] move_mount(2): still breakage around new mount detection) Christian Brauner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250508200332.GH2023217@ZenIV \
--to=viro@zeniv.linux.org.uk \
--cc=brauner@kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).