linux-kernel - [PATCH 2/4] fs/namespace: add umounted mounts to umount_mnt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251002125422.203598-3-b.sachdev1904@gmail.com>
Date: Thu,  2 Oct 2025 18:18:38 +0530
From: Bhavik Sachdev <b.sachdev1904@...il.com>
To: Alexander Viro <viro@...iv.linux.org.uk>,
	Christian Brauner <brauner@...nel.org>
Cc: linux-fsdevel@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Aleksa Sarai <cyphar@...har.com>,
	Bhavik Sachdev <b.sachdev1904@...il.com>,
	Pavel Tikhomirov <ptikhomirov@...tuozzo.com>,
	Jan Kara <jack@...e.cz>,
	John Garry <john.g.garry@...cle.com>,
	Arnaldo Carvalho de Melo <acme@...hat.com>,
	"Darrick J . Wong" <djwong@...nel.org>,
	Namhyung Kim <namhyung@...nel.org>,
	Ingo Molnar <mingo@...nel.org>,
	Andrei Vagin <avagin@...il.com>,
	Alexander Mikhalitsyn <alexander@...alicyn.com>
Subject: [PATCH 2/4] fs/namespace: add umounted mounts to umount_mnt_ns

From: Pavel Tikhomirov <ptikhomirov@...tuozzo.com>

This patch add "unmounted" mounts to umount_mnt_ns instead of mount
namespace being NULL for such mounts. This will allow us to later use
statmount to get mount info about these mounts.

We also introduce proper checks so that "unmounted" mounts are still
detected correctly.

We delete mounts from umount_mnt_ns when no references to them exist.

Signed-off-by: Pavel Tikhomirov <ptikhomirov@...tuozzo.com>
---
 fs/d_path.c    |  2 +-
 fs/mount.h     | 10 +++++++++-
 fs/namespace.c | 23 ++++++++++++++++++++---
 3 files changed, 30 insertions(+), 5 deletions(-)

diff --git a/fs/d_path.c b/fs/d_path.c
index bb365511066b..c6a4118899e1 100644
--- a/fs/d_path.c
+++ b/fs/d_path.c
@@ -119,7 +119,7 @@ static int __prepend_path(const struct dentry *dentry, const struct mount *mnt,
 			/* Global root */
 			mnt_ns = READ_ONCE(mnt->mnt_ns);
 			/* open-coded is_mounted() to use local mnt_ns */
-			if (!IS_ERR_OR_NULL(mnt_ns) && !is_anon_ns(mnt_ns))
+			if (!IS_ERR_OR_NULL(mnt_ns) && !is_anon_ns(mnt_ns) && !is_umount_ns(mnt_ns))
 				return 1;	// absolute root
 			else
 				return 2;	// detached or not attached yet
diff --git a/fs/mount.h b/fs/mount.h
index 97737051a8b9..03f8165939b4 100644
--- a/fs/mount.h
+++ b/fs/mount.h
@@ -122,10 +122,18 @@ static inline int mnt_has_parent(const struct mount *mnt)
 	return mnt != mnt->mnt_parent;
 }
 
+extern struct mnt_namespace *umount_mnt_ns;
+
+static inline bool is_umount_ns(struct mnt_namespace *ns)
+{
+	return ns == umount_mnt_ns;
+}
+
 static inline int is_mounted(struct vfsmount *mnt)
 {
+	struct mnt_namespace *ns = READ_ONCE(real_mount(mnt)->mnt_ns);
 	/* neither detached nor internal? */
-	return !IS_ERR_OR_NULL(real_mount(mnt)->mnt_ns);
+	return !IS_ERR_OR_NULL(ns) && !is_umount_ns(ns);
 }
 
 extern struct mount *__lookup_mnt(struct vfsmount *, struct dentry *);
diff --git a/fs/namespace.c b/fs/namespace.c
index 70fe01d810df..0b4be12c02de 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1016,7 +1016,7 @@ static inline bool check_anonymous_mnt(struct mount *mnt)
 {
 	u64 seq;
 
-	if (!is_anon_ns(mnt->mnt_ns))
+	if (!is_anon_ns(mnt->mnt_ns) || is_umount_ns(mnt->mnt_ns))
 		return false;
 
 	seq = mnt->mnt_ns->seq_origin;
@@ -1400,9 +1400,11 @@ static void mntput_no_expire(struct mount *mnt)
 {
 	LIST_HEAD(list);
 	int count;
+	struct mnt_namespace *ns;
 
 	rcu_read_lock();
-	if (likely(READ_ONCE(mnt->mnt_ns))) {
+	ns = READ_ONCE(mnt->mnt_ns);
+	if (likely(ns && !is_umount_ns(ns))) {
 		/*
 		 * Since we don't do lock_mount_hash() here,
 		 * ->mnt_ns can change under us.  However, if it's
@@ -1438,6 +1440,18 @@ static void mntput_no_expire(struct mount *mnt)
 	mnt->mnt.mnt_flags |= MNT_DOOMED;
 	rcu_read_unlock();
 
+	if (mnt_ns_attached(mnt)) {
+		struct mnt_namespace *ns;
+
+		move_from_ns(mnt);
+		ns = mnt->mnt_ns;
+		if (ns) {
+			ns->nr_mounts--;
+			__touch_mnt_namespace(ns);
+		}
+		mnt->mnt_ns = NULL;
+	}
+
 	list_del(&mnt->mnt_instance);
 	if (unlikely(!list_empty(&mnt->mnt_expire)))
 		list_del(&mnt->mnt_expire);
@@ -1885,6 +1899,9 @@ static void umount_tree(struct mount *mnt, enum umount_tree_flags how)
 		 * namespace, etc.
 		 */
 		mnt_notify_add(p);
+
+		mnt_add_to_ns(umount_mnt_ns, p);
+		umount_mnt_ns->nr_mounts++;
 	}
 }
 
@@ -4804,7 +4821,7 @@ static int can_idmap_mount(const struct mount_kattr *kattr, struct mount *mnt)
 		return -EPERM;
 
 	/* Mount has already been visible in the filesystem hierarchy. */
-	if (!is_anon_ns(mnt->mnt_ns))
+	if (!is_anon_ns(mnt->mnt_ns) || is_umount_ns(mnt->mnt_ns))
 		return -EINVAL;
 
 	return 0;
-- 
2.51.0