linux-kernel - Re: [PATCH] fs/namespace: correctly handle errors returned by grab_requested_mnt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CANaxB-wmgGt3Mt+B3LJc4ajVUdTZEQBUaDPcJnDGStgSD0gtbQ@mail.gmail.com>
Date: Sun, 23 Nov 2025 07:15:16 -0800
From: Andrei Vagin <avagin@...il.com>
To: Mark Brown <broonie@...nel.org>
Cc: Andrei Vagin <avagin@...gle.com>, Christian Brauner <brauner@...nel.org>, linux-kernel@...r.kernel.org, 
	linux-fsdevel@...r.kernel.org, Alexander Viro <viro@...iv.linux.org.uk>, 
	Jan Kara <jack@...e.cz>
Subject: Re: [PATCH] fs/namespace: correctly handle errors returned by grab_requested_mnt_ns

On Sun, Nov 23, 2025 at 4:51 AM Mark Brown <broonie@...nel.org> wrote:
>
> On Tue, Nov 11, 2025 at 06:28:15AM +0000, Andrei Vagin wrote:
> > grab_requested_mnt_ns was changed to return error codes on failure, but
> > its callers were not updated to check for error pointers, still checking
> > only for a NULL return value.
>
> I'm seeing regressions in mainline in the LTP listmount04 test on some
> arm64 platforms:
>
> tst_test.c:1953: TINFO: LTP version: 20250530
> tst_test.c:1956: TINFO: Tested kernel: 6.18.0-rc6-00270-g89edd36fd801 #1 SMP PREEMPT @1763835814 aarch64
> tst_kconfig.c:88: TINFO: Parsing kernel config '/proc/config.gz'
> tst_test.c:1774: TINFO: Overall timeout per run is 0h 05m 24s
> listmount04.c:128: TPASS: request points to unaccessible memory : EFAULT (14)
> listmount04.c:128: TPASS: mnt_ids points to unaccessible memory : EFAULT (14)
> listmount04.c:128: TPASS: invalid flags : EINVAL (22)
> listmount04.c:128: TPASS: insufficient mnt_id_req.size : EINVAL (22)
> listmount04.c:128: TFAIL: invalid mnt_id_req.spare expected EINVAL: EBADF (9)
> listmount04.c:128: TPASS: invalid mnt_id_req.param : EINVAL (22)
> listmount04.c:128: TPASS: invalid mnt_id_req.mnt_id : EINVAL (22)
> listmount04.c:128: TPASS: non-existant mnt_id : ENOENT (2)
>
> which bisect to this patch.  I'm not sure if the change in error code
> here is actually a real issue or not, this feels like an overly
> sensitive test, but perhaps there's some spec requirement or something
> so it seemed reasonable to report.

The merged patch is slightly different from what you can see on the
mailing list, so it's better to look at commit 78f0e33cd6c93
("fs/namespace: correctly handle errors returned by
grab_requested_mnt_ns") to understand what is going on here.

With this patch, the spare field can be used as the `mnt_ns_fd`. EINVAL
is returned if both mnt_ns_fd and mnt_ns_id are set. A non-zero
mnt_ns_fd (the old spare) is interpreted as a namespace file descriptor.

Thanks,
Andrei