brain-hackers_pepepper-mirror/linux-brain
1
0
Fork 0
mirror of https://github.com/brain-hackers/linux-brain.git synced 2024-06-09 15:26:21 +09:00
Code Issues Projects Releases Wiki Activity

do_move_mount(): fix an unsafe use of is_anon_ns()

Browse Source 
What triggers it is a race between mount --move and umount -l
of the source; we should reject it (the source is parentless *and*
not the root of anon namespace at that), but the check for namespace
being an anon one is broken in that case - is_anon_ns() needs
ns to be non-NULL.  Better fixed here than in is_anon_ns(), since
the rest of the callers is guaranteed to get a non-NULL argument...

Reported-by: syzbot+494c7ddf66acac0ad747@syzkaller.appspotmail.com
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
This commit is contained in:
Al Viro 2019-05-09 02:32:28 -04:00
parent 80f232121b
commit 05883eee85
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
fs/namespace.c
View File

@ -2599,7 +2599,7 @@ static int do_move_mount(struct path *old_path, struct path *new_path)
if (attached && !check_mnt(old))
goto out;
if (!attached && !is_anon_ns(ns))
if (!attached && !(ns && is_anon_ns(ns)))
goto out;
if (old->mnt.mnt_flags & MNT_LOCKED)