From mboxrd@z Thu Jan 1 00:00:00 1970 From: Al Viro Subject: Re: WARNING: refcount bug in should_fail Date: Mon, 2 Apr 2018 22:52:12 +0100 Message-ID: <20180402215212.GF30522@ZenIV.linux.org.uk> References: <94eb2c0b816e88bfc50568c6fed5@google.com> <201804011941.IAE69652.OHMVJLFtSOFFQO@I-love.SAKURA.ne.jp> <87lge5z6yn.fsf@xmission.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: Tetsuo Handa , syzbot+@syzkaller.appspotmail.com, syzkaller-bugs@googlegroups.com, dvyukov@google.com, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, netdev@vger.kernel.org To: "Eric W. Biederman" Return-path: Received: from zeniv.linux.org.uk ([195.92.253.2]:38072 "EHLO ZenIV.linux.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753256AbeDBVwV (ORCPT ); Mon, 2 Apr 2018 17:52:21 -0400 Content-Disposition: inline In-Reply-To: <87lge5z6yn.fsf@xmission.com> Sender: netdev-owner@vger.kernel.org List-ID: On Mon, Apr 02, 2018 at 03:30:56PM -0500, Eric W. Biederman wrote: > Tetsuo Handa writes: > > I don't think this is a dup of existing bug. > > We need to fix either 9ee332d99e4d5a97 or d91ee87d8d85a080. > > Even if expanding mount_ns to more filesystems was magically fixed, > proc would still have this issue with the pid namespace rather than > the net namespace. > > This is a mess. I will take a look and see if I can see a a fix. It's trivially fixable, and there's no need to modify mount_ns() at all. All we need is for rpc_kill_sb() to recognize whether we are already through the point in rpc_fill_super() where the refcount is bumped. That's it. The most trivial way to do that is to move net = get_net(sb->s_fs_info); past if (!root) return -ENOMEM; in the latter and have out: if (!sb->s_root) net = NULL; kill_litter_super(sb); if (net) put_net(net); in the end of the former. And similar changes in other affected instances.