linux-fsdevel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Al Viro <viro@zeniv.linux.org.uk>
To: Christian Brauner <brauner@kernel.org>
Cc: linux-fsdevel@vger.kernel.org,
	Linus Torvalds <torvalds@linux-foundation.org>
Subject: reproducer for "do_move_mount(): don't leak MNTNS_PROPAGATING on failures"
Date: Thu, 8 May 2025 21:03:32 +0100	[thread overview]
Message-ID: <20250508200332.GH2023217@ZenIV> (raw)
In-Reply-To: <20250508200211.GF2023217@ZenIV>

#include <string.h>
#include <unistd.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <stdio.h>

static int tmpfs(const char *name)
{
	return mount("none", name, "tmpfs", 0, NULL);
}
static int change(const char *name, int how)
{
	return mount(NULL, name, NULL, how, NULL);
}
static int bind(const char *from, const char *to)
{
	return mount(from, to, NULL, MS_BIND, NULL);
}
static _Bool exists(const char *name)
{
	return access(name, F_OK) != -1;
}

void playground(void)
{
	mkdir("/tmp/foo", 0700);
	tmpfs("/tmp/foo");
	change("/tmp/foo", MS_PRIVATE);
	chdir("/tmp/foo");
}

void cleanup(int fd)
{
	close(fd);
	chdir("/tmp");
	umount2("/tmp/foo", MNT_DETACH);
	rmdir("/tmp/foo");
}

main()
{
	playground();

	mkdir("A", 0700);
        mkdir("A/subdir", 0700);
	mkdir("B", 0700);
	bind("A", "A");
	change("A", MS_SHARED);

        int fd = open_tree(AT_FDCWD, "A", OPEN_TREE_CLONE);

	// this move_mount should fail (directory on top of non-directory)
        if (move_mount(fd, "", AT_FDCWD, "/dev/null", MOVE_MOUNT_F_EMPTY_PATH) == 0) {
		printf("unexpected success of first move_mount()\n");
		cleanup(fd);
		return -1;
	}
	// this should propagate into detached tree
	tmpfs("A/subdir");
	mkdir("A/subdir/foo", 0700);
	// move detached tree in, so we could check it
	if (move_mount(fd, "", AT_FDCWD, "B", MOVE_MOUNT_F_EMPTY_PATH) != 0) {
		printf("unexpected failure of the second move_mount()\n");
		cleanup(fd);
	}
	if (!exists("B/subdir/foo")) {
		printf("failed to propagate into detached tree\n");
		cleanup(fd);
		return -1;
	}

	printf("success\n");
	cleanup(fd);
	return 0;
}

  reply	other threads:[~2025-05-08 20:03 UTC|newest]

Thread overview: 29+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-04-28  6:30 [RFC] move_mount(2): still breakage around new mount detection Al Viro
2025-04-28  7:03 ` Al Viro
2025-04-28  8:50   ` Christian Brauner
2025-04-28 18:53     ` Al Viro
2025-04-29  4:03       ` Al Viro
2025-04-29  5:10         ` Al Viro
2025-04-29  5:27           ` Al Viro
2025-04-29  8:21           ` Christian Brauner
2025-05-05  5:08           ` Al Viro
2025-05-05 14:20             ` Christian Brauner
2025-04-29  7:56         ` Christian Brauner
2025-04-29 12:27           ` Al Viro
2025-04-29  7:52       ` Christian Brauner
2025-05-08  5:56       ` more breakage there (was Re: [RFC] move_mount(2): still breakage around new mount detection) Al Viro
2025-05-08 19:59         ` Al Viro
2025-05-08 20:00           ` [PATCH 1/4] __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock Al Viro
2025-05-09 11:02             ` Christian Brauner
2025-05-08 20:01           ` [PATCH 2/4] do_umount(): add missing barrier before refcount checks in sync case Al Viro
2025-05-09 11:02             ` Christian Brauner
2025-05-08 20:02           ` [PATCH 3/4] do_move_mount(): don't leak MNTNS_PROPAGATING on failures Al Viro
2025-05-08 20:03             ` Al Viro [this message]
2025-05-09 11:02             ` Christian Brauner
2025-05-13 11:03             ` Lai, Yi
2025-05-13 12:08               ` Al Viro
2025-05-13 14:33                 ` Lai, Yi
2025-05-08 20:02           ` [PATCH 4/4] fix IS_MNT_PROPAGATING uses Al Viro
2025-05-08 20:04             ` reproducer for "fix IS_MNT_PROPAGATING uses" Al Viro
2025-05-09 11:01             ` [PATCH 4/4] fix IS_MNT_PROPAGATING uses Christian Brauner
2025-05-09 11:06         ` more breakage there (was Re: [RFC] move_mount(2): still breakage around new mount detection) Christian Brauner

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20250508200332.GH2023217@ZenIV \
    --to=viro@zeniv.linux.org.uk \
    --cc=brauner@kernel.org \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=torvalds@linux-foundation.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).