linux-kernel - Re: [GIT PULL] vfs mount

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <7c74d5a93026d515a9e7a21ba5a0fcf962415662.camel@HansenPartnership.com>
Date: Thu, 03 Apr 2025 15:38:21 -0400
From: James Bottomley <James.Bottomley@...senPartnership.com>
To: Leon Romanovsky <leon@...nel.org>, Christian Brauner <brauner@...nel.org>
Cc: Linus Torvalds <torvalds@...ux-foundation.org>,
 pr-tracker-bot@...nel.org,  linux-fsdevel@...r.kernel.org,
 linux-kernel@...r.kernel.org
Subject: Re: [GIT PULL] vfs mount

On Thu, 2025-04-03 at 21:24 +0300, Leon Romanovsky wrote:
> On Thu, Apr 03, 2025 at 05:15:38PM +0200, Christian Brauner wrote:
> > On Thu, Apr 03, 2025 at 10:29:37AM +0200, Christian Brauner wrote:
> > > On Tue, Apr 01, 2025 at 08:07:15PM +0300, Leon Romanovsky wrote:
> > > > On Mon, Mar 24, 2025 at 09:00:59PM +0000,
> > > > pr-tracker-bot@...nel.org wrote:
> > > > > The pull request you sent on Sat, 22 Mar 2025 11:13:18 +0100:
> > > > > 
> > > > > > git@...olite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs
> > > > > > tags/vfs-6.15-rc1.mount
> > > > > 
> > > > > has been merged into torvalds/linux.git:
> > > > > https://git.kernel.org/torvalds/c/fd101da676362aaa051b4f5d8a941bd308603041
> > > > 
> > > > I didn't bisect, but this PR looks like the most relevant
> > > > candidate.
> > > > The latest Linus's master generates the following slab-use-
> > > > after-free:
> > > 
> > > Sorry, did just see this today. I'll take a look now.
> > 
> > So in light of "Liberation Day" and the bug that caused this splat
> > it's time to quote Max Liebermann:
> > 
> > "Ich kann nicht so viel fressen, wie ich kotzen möchte."
> 
> > From 8822177b7a8a7315446b4227c7eb7a36916a6d6d Mon Sep 17 00:00:00
> > 2001
> > From: Christian Brauner <brauner@...nel.org>
> > Date: Thu, 3 Apr 2025 16:43:50 +0200
> > Subject: [PATCH] fs: actually hold the namespace semaphore
> > 
> > Don't use a scoped guard use a regular guard to make sure that the
> > namespace semaphore is held across the whole function.
> > 
> > Signed-off-by: Christian Brauner <brauner@...nel.org>
> > ---
> >  fs/namespace.c | 3 ++-
> >  1 file changed, 2 insertions(+), 1 deletion(-)
> > 
> > diff --git a/fs/namespace.c b/fs/namespace.c
> > index 16292ff760c9..348008b9683b 100644
> > --- a/fs/namespace.c
> > +++ b/fs/namespace.c
> > @@ -2478,7 +2478,8 @@ struct vfsmount *clone_private_mount(const
> > struct path *path)
> >  	struct mount *old_mnt = real_mount(path->mnt);
> >  	struct mount *new_mnt;
> >  
> > -	scoped_guard(rwsem_read, &namespace_sem)
> > +	guard(rwsem_read, &namespace_sem);
> 
> I'm looking at Linus's master commit a2cc6ff5ec8f ("Merge tag
> 'firewire-updates-6.15' of
> git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394")
> and guard is declared as macro which gets only one argument:
> include/linux/cleanup.h
>   318 #define guard(_name) \
>   319         CLASS(_name, __UNIQUE_ID(guard))
> 
> 
> 
> 20:52:24  fs/namespace.c: In function 'clone_private_mount':
> 20:52:24  fs/namespace.c:2481:41: error: macro "guard" passed 2
> arguments, but takes just 1
> 20:52:24   2481 |         guard(rwsem_read, &namespace_sem);
> 20:52:24        |                                         ^
> 20:52:24  In file included from ./include/linux/preempt.h:11,
> 20:52:24                   from ./include/linux/spinlock.h:56,
> 20:52:24                   from ./include/linux/wait.h:9,
> 20:52:24                   from ./include/linux/wait_bit.h:8,
> 20:52:24                   from ./include/linux/fs.h:7,
> 20:52:24                   from ./include/uapi/linux/aio_abi.h:31,
> 20:52:24                   from ./include/linux/syscalls.h:83,
> 20:52:24                   from fs/namespace.c:11:
> 20:52:24  ./include/linux/cleanup.h:318:9: note: macro "guard"
> defined here
> 20:52:24    318 | #define guard(_name) \
> 20:52:24        |         ^~~~~
> 20:52:24  fs/namespace.c:2481:9: error: 'guard' undeclared (first use
> in this function)
> 20:52:24   2481 |         guard(rwsem_read, &namespace_sem);
> 20:52:24        |         ^~~~~
> 20:52:24  fs/namespace.c:2481:9: note: each undeclared identifier is
> reported only once for each function it appears in
> 
> Do I need to apply extra patch?

I think the statement should be

guard(rwsem_read)(&namespace_sem);

Regards,

James