Re: [GIT PULL] vfs mount

[Christian Brauner <brauner@kernel.org>]

[-- Attachment #1: Type: text/plain, Size: 886 bytes --]

On Thu, Apr 03, 2025 at 10:29:37AM +0200, Christian Brauner wrote:
> On Tue, Apr 01, 2025 at 08:07:15PM +0300, Leon Romanovsky wrote:
> > On Mon, Mar 24, 2025 at 09:00:59PM +0000, pr-tracker-bot@kernel.org wrote:
> > > The pull request you sent on Sat, 22 Mar 2025 11:13:18 +0100:
> > > 
> > > > git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-6.15-rc1.mount
> > > 
> > > has been merged into torvalds/linux.git:
> > > https://git.kernel.org/torvalds/c/fd101da676362aaa051b4f5d8a941bd308603041
> > 
> > I didn't bisect, but this PR looks like the most relevant candidate.
> > The latest Linus's master generates the following slab-use-after-free:
> 
> Sorry, did just see this today. I'll take a look now.

So in light of "Liberation Day" and the bug that caused this splat it's
time to quote Max Liebermann:

"Ich kann nicht so viel fressen, wie ich kotzen möchte."

[-- Attachment #2: 0001-fs-actually-hold-the-namespace-semaphore.patch --]
[-- Type: text/x-diff, Size: 912 bytes --]

From 8822177b7a8a7315446b4227c7eb7a36916a6d6d Mon Sep 17 00:00:00 2001
From: Christian Brauner <brauner@kernel.org>
Date: Thu, 3 Apr 2025 16:43:50 +0200
Subject: [PATCH] fs: actually hold the namespace semaphore

Don't use a scoped guard use a regular guard to make sure that the
namespace semaphore is held across the whole function.

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 fs/namespace.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/namespace.c b/fs/namespace.c
index 16292ff760c9..348008b9683b 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -2478,7 +2478,8 @@ struct vfsmount *clone_private_mount(const struct path *path)
 	struct mount *old_mnt = real_mount(path->mnt);
 	struct mount *new_mnt;
 
-	scoped_guard(rwsem_read, &namespace_sem)
+	guard(rwsem_read, &namespace_sem);
+
 	if (IS_MNT_UNBINDABLE(old_mnt))
 		return ERR_PTR(-EINVAL);
 
-- 
2.47.2