linux-kernel - Re: [PATCH] fs/namespace.c: fix use-after-free of mount in mnt_warn_timestamp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20191014032242.GD10007@sol.localdomain>
Date:   Sun, 13 Oct 2019 20:22:42 -0700
From:   Eric Biggers <ebiggers@...nel.org>
To:     Deepa Dinamani <deepa.kernel@...il.com>,
        Alexander Viro <viro@...iv.linux.org.uk>
Cc:     Linux FS-devel Mailing List <linux-fsdevel@...r.kernel.org>,
        Arnd Bergmann <arnd@...db.de>,
        Jeff Layton <jlayton@...nel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        syzkaller-bugs@...glegroups.com
Subject: Re: [PATCH] fs/namespace.c: fix use-after-free of mount in
 mnt_warn_timestamp_expiry()

On Sun, Oct 13, 2019 at 07:04:10PM -0700, Deepa Dinamani wrote:
> Thanks for the fix.
> 
> Would it be better to move the check and warning to a place where the
> access is still safe?
> 
> -Deepa

True, we could just do

diff --git a/fs/namespace.c b/fs/namespace.c
index fe0e9e1410fe..9f2ceb542f05 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -2764,14 +2764,14 @@ static int do_new_mount_fc(struct fs_context *fc, struct path *mountpoint,
 	if (IS_ERR(mnt))
 		return PTR_ERR(mnt);
 
+	mnt_warn_timestamp_expiry(mountpoint, mnt);
+
 	error = do_add_mount(real_mount(mnt), mountpoint, mnt_flags);
 	if (error < 0) {
 		mntput(mnt);
 		return error;
 	}
 
-	mnt_warn_timestamp_expiry(mountpoint, mnt);
-
 	return error;
 }

But then the warning ("Mounted %s file system ...") is printed even if
do_add_mount() fails so nothing was actually mounted.

Though, it's just a warning message and I think failures here are rare, so maybe
we don't care.  Al, what do you think?

- Eric