linux-kernel - Re: [PATCH Next] copy_mnt_ns(): Remove unnecessary unlock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250929-wettmachen-gitarre-c5c25dcfd3bf@brauner>
Date: Mon, 29 Sep 2025 11:23:09 +0200
From: Christian Brauner <brauner@...nel.org>
To: Al Viro <viro@...iv.linux.org.uk>
Cc: Jan Kara <jack@...e.cz>, Edward Adam Davis <eadavis@...com>, 
	syzbot+0d671007a95cd2835e05@...kaller.appspotmail.com, linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org, 
	syzkaller-bugs@...glegroups.com
Subject: Re: [PATCH Next] copy_mnt_ns(): Remove unnecessary unlock

On Wed, Sep 24, 2025 at 06:56:41PM +0100, Al Viro wrote:
> On Wed, Sep 24, 2025 at 02:03:56PM +0200, Jan Kara wrote:
> > On Wed 24-09-25 18:29:04, Edward Adam Davis wrote:
> > > This code segment is already protected by guards, namespace_unlock()
> > > should not appear here.
> > > 
> > > Reported-by: syzbot+0d671007a95cd2835e05@...kaller.appspotmail.com
> > > Closes: https://syzkaller.appspot.com/bug?extid=0d671007a95cd2835e05
> > > Signed-off-by: Edward Adam Davis <eadavis@...com>
> > 
> > Indeed. Feel free to add:
> > 
> > Reviewed-by: Jan Kara <jack@...e.cz>
> 
> I wonder where does that line come from, though.  Mismerge somewhere?
> d7b7253a0adc "copy_mnt_ns(): use guards" includes this:
> 
> @@ -4185,13 +4186,11 @@ struct mnt_namespace *copy_mnt_ns(unsigned long flags, struct mnt_namespace *ns,
>  	new = copy_tree(old, old->mnt.mnt_root, copy_flags);
>  	if (IS_ERR(new)) {
>  		emptied_ns = new_ns;
> -		namespace_unlock();
>  		return ERR_CAST(new);
>  	}
>  	if (user_ns != ns->user_ns) {
> -		lock_mount_hash();
> +		guard(mount_writer)();
>  		lock_mnt_tree(new);
> -		unlock_mount_hash();
>  	}
>  	new_ns->root = new;
>  

Fwiw, I just pulled next-20250926 and I don't see this bug. So I'm not
sure it's even a merge conflict or it was in an earlier -next version.