[PATCH] statmount: Fix the null-ptr-deref in do_statmount()

[PATCH] statmount: Fix the null-ptr-deref in do_statmount()

[Qing Wang]

If the mount is internal, it's mnt_ns will be MNT_NS_INTERNAL, which is
defined as ERR_PTR(-EINVAL). So, in the do_statmount(), need to check ns
of mount by IS_ERR_OR_NULL().

Fixes: 0e5032237ee5 ("statmount: accept fd as a parameter")
Reported-by: syzbot+9e03a9535ea65f687a44@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/698e287a.a70a0220.2c38d7.009e.GAE@google.com/
Tested-by: syzbot+9e03a9535ea65f687a44@syzkaller.appspotmail.com
Signed-off-by: Qing Wang <wangqing7171@gmail.com>
---
 fs/namespace.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/fs/namespace.c b/fs/namespace.c
index a67cbe42746d..d769d50de5d6 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -5678,13 +5678,15 @@ static int do_statmount(struct kstatmount *s, u64 mnt_id, u64 mnt_ns_id,
 
 		s->mnt = mnt_file->f_path.mnt;
 		ns = real_mount(s->mnt)->mnt_ns;
-		if (!ns)
+		if (IS_ERR_OR_NULL(ns)) {
 			/*
 			 * We can't set mount point and mnt_ns_id since we don't have a
 			 * ns for the mount. This can happen if the mount is unmounted
-			 * with MNT_DETACH.
+			 * with MNT_DETACH or if it's an internal mount.
 			 */
 			s->mask &= ~(STATMOUNT_MNT_POINT | STATMOUNT_MNT_NS_ID);
+			ns = NULL;
+		}
 	} else {
 		/* Has the namespace already been emptied? */
 		if (mnt_ns_id && mnt_ns_empty(ns))
-- 
2.34.1

Re: [PATCH] statmount: Fix the null-ptr-deref in do_statmount()

[Bhavik Sachdev]

On Fri Feb 13, 2026 at 2:12 PM IST, Qing Wang wrote:
> If the mount is internal, it's mnt_ns will be MNT_NS_INTERNAL, which is
> defined as ERR_PTR(-EINVAL). So, in the do_statmount(), need to check ns
> of mount by IS_ERR_OR_NULL().
>
> Fixes: 0e5032237ee5 ("statmount: accept fd as a parameter")
> Reported-by: syzbot+9e03a9535ea65f687a44@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/all/698e287a.a70a0220.2c38d7.009e.GAE@google.com/
> Tested-by: syzbot+9e03a9535ea65f687a44@syzkaller.appspotmail.com
> Signed-off-by: Qing Wang <wangqing7171@gmail.com>
> ---
>  fs/namespace.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/fs/namespace.c b/fs/namespace.c
> index a67cbe42746d..d769d50de5d6 100644
> --- a/fs/namespace.c
> +++ b/fs/namespace.c
> @@ -5678,13 +5678,15 @@ static int do_statmount(struct kstatmount *s, u64 mnt_id, u64 mnt_ns_id,
>  
>  		s->mnt = mnt_file->f_path.mnt;
>  		ns = real_mount(s->mnt)->mnt_ns;
> -		if (!ns)
> +		if (IS_ERR_OR_NULL(ns)) {
>  			/*
>  			 * We can't set mount point and mnt_ns_id since we don't have a
>  			 * ns for the mount. This can happen if the mount is unmounted
> -			 * with MNT_DETACH.
> +			 * with MNT_DETACH or if it's an internal mount.
>  			 */
>  			s->mask &= ~(STATMOUNT_MNT_POINT | STATMOUNT_MNT_NS_ID);
> +			ns = NULL;
> +		}
>  	} else {
>  		/* Has the namespace already been emptied? */
>  		if (mnt_ns_id && mnt_ns_empty(ns))
Hey!
I think the fix should be the following instead, AFAIU we don't want a
call to an internal mount to succeed.

diff --git a/fs/namespace.c b/fs/namespace.c
index a67cbe42746d..55152bf64785 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -5678,6 +5678,8 @@ static int do_statmount(struct kstatmount *s, u64 mnt_id, u64 mnt_ns_id,

                s->mnt = mnt_file->f_path.mnt;
                ns = real_mount(s->mnt)->mnt_ns;
+               if (IS_ERR(ns))
+                       return -EINVAL;
                if (!ns)
                        /*
                         * We can't set mount point and mnt_ns_id since we don't have a

Thanks,
Bhavik

Re: Re: [PATCH] statmount: Fix the null-ptr-deref in do_statmount()

[Qing Wang]

On Fri, 13 Feb 2026 at 17:38, "Bhavik Sachdev" <b.sachdev1904@gmail.com> wrote:
> Hey!
> I think the fix should be the following instead, AFAIU we don't want a
> call to an internal mount to succeed.
> 
> diff --git a/fs/namespace.c b/fs/namespace.c
> index a67cbe42746d..55152bf64785 100644
> --- a/fs/namespace.c
> +++ b/fs/namespace.c
> @@ -5678,6 +5678,8 @@ static int do_statmount(struct kstatmount *s, u64 mnt=
> _id, u64 mnt_ns_id,
> 
>                 s->mnt =3D mnt_file->f_path.mnt;
>                 ns =3D real_mount(s->mnt)->mnt_ns;
> +               if (IS_ERR(ns))
> +                       return -EINVAL;
>                 if (!ns)
>                         /*
>                          * We can't set mount point and mnt_ns_id since we =
> don't have a
> 
> Thanks,
> Bhavik

I had considered returning an error code before but finally decided to
not. Thank you for your suggestion, I agree with it and resend the patch
v3 [0].

[0] https://lore.kernel.org/all/20260213103006.2472569-1-wangqing7171@gmail.com/T/

Look forward to your review.

---
Thanks,
Qing