public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
* [PATCH] fs/namespace: fix NULL pointer dereference in do_lock_mount()
@ 2026-05-05  9:51 Vineet Agarwal
  2026-05-05 14:43 ` Jori Koolstra
  0 siblings, 1 reply; 5+ messages in thread
From: Vineet Agarwal @ 2026-05-05  9:51 UTC (permalink / raw)
  To: viro; +Cc: brauner, jack, linux-fsdevel, linux-kernel, Vineet Agarwal,
	syzbot

Syzkaller reported a NULL pointer dereference in do_lock_mount()
when calling inode_lock() on a dentry without an associated inode.

where_to_mount() may return a negative dentry (without an inode)
due to concurrent unlink or mount changes. The current code does
not validate this before calling inode_lock(), leading to a crash.

Fix this by checking dentry and dentry->d_inode before acquiring
the inode lock.

Reported-by: syzbot <syzbot@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/
Signed-off-by: Vineet Agarwal <agarwal.vineet2006@gmail.com>
---
 fs/namespace.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/fs/namespace.c b/fs/namespace.c
index fe919abd2f01..b1dccdf06836 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -2760,6 +2760,17 @@ static void do_lock_mount(const struct path *path,
 			}
 		}
 
+		if (unlikely(!dentry || !dentry->d_inode)) {
+			err = -ENOENT;
+			if (&m->mnt != path->mnt) {
+				if (dentry)
+					dput(dentry);
+				mntput(&m->mnt);
+			}
+			res->parent = ERR_PTR(err);
+			return;
+		}
+
 		inode_lock(dentry->d_inode);
 		namespace_lock();
 
-- 
2.54.0


^ permalink raw reply related	[flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-05-06  4:37 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-05  9:51 [PATCH] fs/namespace: fix NULL pointer dereference in do_lock_mount() Vineet Agarwal
2026-05-05 14:43 ` Jori Koolstra
     [not found]   ` <CA+rjy8fM+8ahj7dcBWjnACU8xBWBqW4ssQFpi68dqRc-F-V3Xg@mail.gmail.com>
2026-05-06  2:12     ` Al Viro
2026-05-06  2:21       ` Al Viro
2026-05-06  4:37         ` Vineet Agarwal

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox