archives/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-03-08 03:44:45 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
linux/fs
History
Christian Brauner a41dbf5e00
mount: hold namespace_sem across copy in create_new_namespace() 
Fix an oversight when creating a new mount namespace. If someone had the
bright idea to make the real rootfs a shared or dependent mount and it
is later copied the copy will become a peer of the old real rootfs mount
or a dependent mount of it. The namespace semaphore is dropped and we
use mount lock exact to lock the new real root mount. If that fails or
the subsequent do_loopback() fails we rely on the copy of the real root
mount to be cleaned up by path_put(). The problem is that this doesn't
deal with mount propagation and will leave the mounts linked in the
propagation lists.

When creating a new mount namespace create_new_namespace() first
acquires namespace_sem to clone the nullfs root, drops it, then
reacquires it via LOCK_MOUNT_EXACT which takes inode_lock first to
respect the inode_lock -> namespace_sem lock ordering. This
drop-and-reacquire pattern is fragile and was the source of the
propagation cleanup bug fixed in the preceding commit.

Extend lock_mount_exact() with a copy_mount mode that clones the mount
under the locks atomically. When copy_mount is true, path_overmounted()
is skipped since we're copying the mount, not mounting on top of it -
the nullfs root always has rootfs mounted on top so the check would
always fail. If clone_mnt() fails after get_mountpoint() has pinned the
mountpoint, __unlock_mount() is used to properly unpin the mountpoint
and release both locks.

This allows create_new_namespace() to use LOCK_MOUNT_EXACT_COPY which
takes inode_lock and namespace_sem once and holds them throughout the
clone and subsequent mount operations, eliminating the
drop-and-reacquire pattern entirely.

Reported-by: syzbot+a89f9434fb5a001ccd58@syzkaller.appspotmail.com
Fixes: 9b8a0ba682 ("mount: add OPEN_TREE_NAMESPACE") # mainline only
Link: https://lore.kernel.org/699047f6.050a0220.2757fb.0024.GAE@google.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
2026-02-18 14:04:42 +01:00
..
9p vfs-7.0-rc1.misc 2026-02-09 15:13:05 -08:00
adfs kernel.h: drop hex.h and update all hex.h users 2026-01-20 19:44:19 -08:00
affs affs: add setlease file operation 2026-01-12 10:55:45 +01:00
afs Networking changes for 6.19. 2025-12-03 17:24:33 -08:00
autofs vfs-6.19-rc1.fixes 2025-12-05 15:52:30 -08:00
befs fs: add setlease to generic_ro_fops and read-only filesystem directory operations 2026-01-12 10:55:45 +01:00
bfs vfs-6.19-rc1.inode 2025-12-01 09:02:34 -08:00
btrfs fsverity updates for 7.0 2026-02-12 10:41:34 -08:00
cachefiles vfs-6.19-rc1.directory.locking 2025-12-01 16:13:46 -08:00
ceph vfs-7.0-rc1.misc 2026-02-09 15:13:05 -08:00
coda Coccinelle-based conversion to use ->i_state accessors 2025-10-20 20:22:26 +02:00
configfs Some filesystems use a kinda-sorta controlled dentry refcount leak to pin 2025-12-05 14:36:21 -08:00
cramfs fs: add setlease to generic_ro_fops and read-only filesystem directory operations 2026-01-12 10:55:45 +01:00
crypto blk-crypto: handle the fallback above the block layer 2026-01-11 12:55:41 -07:00
debugfs debugfs: Fix memleak in debugfs_change_name(). 2025-12-19 16:43:40 +01:00
devpts convert devpts 2025-11-16 01:35:04 -05:00
dlm Locking updates for v6.20: 2026-02-10 12:28:44 -08:00
ecryptfs mm.git review status for linus..mm-nonmm-stable 2026-02-12 12:13:01 -08:00
efivarfs mm.git review status for linus..mm-nonmm-stable 2026-02-12 12:13:01 -08:00
efs fs: add setlease to generic_ro_fops and read-only filesystem directory operations 2026-01-12 10:55:45 +01:00
erofs Changes since last update: 2026-02-09 16:08:40 -08:00
exfat exfat: add setlease file operation 2026-01-12 10:55:46 +01:00
exportfs
ext2 vfs-7.0-rc1.fserror 2026-02-09 12:21:37 -08:00
ext4 mm.git review status for linus..mm-stable 2026-02-12 11:32:37 -08:00
f2fs fsverity updates for 7.0 2026-02-12 10:41:34 -08:00
fat mm.git review status for linus..mm-nonmm-stable 2026-02-12 12:13:01 -08:00
freevxfs fs: add setlease to generic_ro_fops and read-only filesystem directory operations 2026-01-12 10:55:45 +01:00
fuse fs: fuse: fix max() of incompatible types 2026-02-09 15:19:43 -08:00
gfs2 mm.git review status for linus..mm-nonmm-stable 2026-02-12 12:13:01 -08:00
hfs hfs: Replace BUG_ON with error handling for CNID count checks 2026-01-06 12:39:19 -08:00
hfsplus hfsplus: avoid double unload_nls() on mount failure 2026-02-06 15:20:00 -08:00
hostfs Apart from the usual small churn, we have 2025-12-05 16:30:56 -08:00
hpfs vfs-6.19-rc1.fs_header 2025-12-01 14:18:01 -08:00
hugetlbfs Some filesystems use a kinda-sorta controlled dentry refcount leak to pin 2025-12-05 14:36:21 -08:00
iomap iomap: Describe @private in iomap_readahead() 2026-02-14 13:24:44 +01:00
isofs \n 2026-02-12 10:57:57 -08:00
jbd2 jbd2: fix the inconsistency between checksum and data in memory for journal sb 2025-11-26 17:05:47 -05:00
jffs2 jffs2: add setlease file operation 2026-01-12 10:55:46 +01:00
jfs Just a handful of minor jfs fixes 2026-02-12 09:30:56 -08:00
kernfs fs/kernfs: null-ptr deref in simple_xattrs_free() 2025-12-23 16:14:43 +01:00
lockd sunrpc: allow svc_recv() to return -ETIMEDOUT and -EBUSY 2026-01-28 10:15:42 -05:00
minix vfs-7.0-rc1.minix 2026-02-09 13:38:07 -08:00
netfs netfs: avoid double increment of retry_count in subreq 2026-02-08 17:07:43 -06:00
nfs NFS Client Updates for Linux 7.0 2026-02-12 17:49:33 -08:00
nfs_common NFSD: Remove NFSERR_EAGAIN 2026-01-02 13:43:41 -05:00
nfsd mm.git review status for linus..mm-nonmm-stable 2026-02-12 12:13:01 -08:00
nilfs2 nilfs2 updates for v7.0 2026-02-09 15:55:41 -08:00
nls fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8() 2025-12-01 11:58:06 +02:00
notify fsnotify: Use connector list for destroying inode marks 2026-01-23 13:26:37 +01:00
ntfs3 mm.git review status for linus..mm-nonmm-stable 2026-02-12 12:13:01 -08:00
ocfs2 mm.git review status for linus..mm-nonmm-stable 2026-02-12 12:13:01 -08:00
omfs vfs-6.19-rc1.fs_header 2025-12-01 14:18:01 -08:00
openpromfs Coccinelle-based conversion to use ->i_state accessors 2025-10-20 20:22:26 +02:00
orangefs orangefs: fixes for string handling in orangefs-debugfs.c and xattr.c, 2026-02-12 08:57:31 -08:00
overlayfs mm.git review status for linus..mm-nonmm-stable 2026-02-12 12:13:01 -08:00
proc Three MM hotfixes, all three are cc:stable. 2026-02-13 12:13:27 -08:00
pstore pstore/ram: fix buffer overflow in persistent_ram_save_old() 2026-02-06 16:50:35 -08:00
qnx4 fs: add setlease to generic_ro_fops and read-only filesystem directory operations 2026-01-12 10:55:45 +01:00
qnx6 fs: add setlease to generic_ro_fops and read-only filesystem directory operations 2026-01-12 10:55:45 +01:00
quota \n 2026-02-12 10:57:57 -08:00
ramfs Some filesystems use a kinda-sorta controlled dentry refcount leak to pin 2025-12-05 14:36:21 -08:00
resctrl fs/resctrl: Move RMID initialization to first mount 2026-01-10 11:46:48 +01:00
romfs romfs: check sb_set_blocksize() return value 2026-01-13 09:56:58 +01:00
smb 32 ksmbd and smbdirect fixes 2026-02-12 08:31:12 -08:00
squashfs squashfs: add setlease file operation 2026-01-12 10:55:47 +01:00
sysfs sysfs: remove exports of sysfs_*change_owner() 2026-02-05 16:49:38 +01:00
tests fs/tests: exec: drop duplicate bprm_stack_limits test vectors 2026-02-03 17:39:00 -08:00
tracefs convert tracefs 2025-11-16 01:35:03 -05:00
ubifs fs: add support for non-blocking timestamp updates 2026-01-12 14:01:33 +01:00
udf mm.git review status for linus..mm-nonmm-stable 2026-02-12 12:13:01 -08:00
ufs ufs: add setlease file operation 2026-01-12 10:55:48 +01:00
unicode
vboxsf fs: remove simple_nosetlease() 2026-01-12 10:55:48 +01:00
verity fsverity updates for 7.0 2026-02-12 10:41:34 -08:00
xfs mm.git review status for linus..mm-stable 2026-02-12 11:32:37 -08:00
zonefs vfs-6.19-rc1.inode 2025-12-01 09:02:34 -08:00
aio.c aio: use credential guards 2025-11-04 12:36:33 +01:00
anon_inodes.c anon_inodes: convert to FD_ADD() 2025-11-28 12:42:31 +01:00
attr.c fs,fsverity: reject size changes on fsverity files in setattr_prepare 2026-01-29 09:39:41 -08:00
backing-file.c kernel-6.19-rc1.cred 2025-12-01 13:45:41 -08:00
bad_inode.c fs: refactor ->update_time handling 2026-01-12 14:01:32 +01:00
binfmt_elf.c rseq: Provide and use rseq_set_ids() 2025-11-04 08:33:33 +01:00
binfmt_elf_fdpic.c
binfmt_flat.c
binfmt_misc.c kernel.h: drop hex.h and update all hex.h users 2026-01-20 19:44:19 -08:00
binfmt_script.c
bpf_fs_kfuncs.c bpf: Remove redundant KF_TRUSTED_ARGS flag from all kfuncs 2026-01-02 12:04:28 -08:00
buffer.c fsverity updates for 7.0 2026-02-12 10:41:34 -08:00
char_dev.c chardev: Switch to guard(mutex) and __free(kfree) 2025-12-24 13:55:51 +01:00
compat_binfmt_elf.c
coredump.c hardening updates for v7.0-rc1 2026-02-10 08:54:13 -08:00
d_path.c
dax.c Significant patch series in this merge are as follows: 2025-12-05 13:52:43 -08:00
dcache.c struct filename series 2026-02-09 16:58:28 -08:00
direct-io.c
drop_caches.c Coccinelle-based conversion to use ->i_state accessors 2025-10-20 20:22:26 +02:00
eventfd.c eventfd: convert do_eventfd() to FD_PREPARE() 2025-11-28 12:42:31 +01:00
eventpoll.c eventpoll: convert do_epoll_create() to FD_PREPARE() 2025-11-28 12:42:32 +01:00
exec.c struct filename series 2026-02-09 16:58:28 -08:00
fcntl.c vfs: expose delegation support to userland 2025-11-12 09:38:37 +01:00
fhandle.c name_to_handle_at(): use CLASS(filename_uflags) 2026-01-16 12:52:03 -05:00
file.c vfs-6.19-rc1.fd_prepare.fs 2025-12-01 17:32:07 -08:00
file_attr.c fs: init flags_valid before calling vfs_fileattr_get 2026-02-14 13:17:43 +01:00
file_table.c Changes since last update: 2026-02-09 16:08:40 -08:00
filesystems.c sysfs(2): fs_index() argument is _not_ a pathname 2026-01-16 12:52:04 -05:00
fs-writeback.c writeback: Fix wakeup and logging timeouts for !DETECT_HUNG_TASK 2026-02-14 13:17:46 +01:00
fs_context.c fs: Remove internal old mount API code 2025-12-15 14:48:33 +01:00
fs_dirent.c fs: rename fs_types.h to fs_dirent.h 2025-11-05 09:51:30 +01:00
fs_parser.c
fs_pin.c
fs_struct.c fs: add <linux/init_task.h> for 'init_fs' 2026-01-14 16:50:37 +01:00
fserror.c fs: report filesystem and file I/O errors to fsnotify 2026-01-13 09:58:01 +01:00
fsopen.c struct filename series 2026-02-09 16:58:28 -08:00
init.c struct filename series 2026-02-09 16:58:28 -08:00
inode.c fsverity updates for 7.0 2026-02-12 10:41:34 -08:00
internal.h struct filename series 2026-02-09 16:58:28 -08:00
ioctl.c fs: remove vfs_ioctl export 2025-09-01 13:08:01 +02:00
Kconfig Summary of significant series in this pull request: 2025-10-02 18:18:33 -07:00
Kconfig.binfmt binfmt_elf: preserve original ELF e_flags for core dumps 2025-09-03 20:49:32 -07:00
kernel_read_file.c
libfs.c fs: remove simple_nosetlease() 2026-01-12 10:55:48 +01:00
locks.c NFSD 7.0 Release Notes 2026-02-12 08:23:53 -08:00
Makefile vfs-7.0-rc1.nullfs 2026-02-09 13:41:34 -08:00
mbcache.c
mnt_idmapping.c
mount.h fs: add immutable rootfs 2026-01-12 16:52:09 +01:00
mpage.c mpage: convert do_mpage_readpage() to return void type 2025-09-21 14:22:16 -07:00
namei.c struct filename series 2026-02-09 16:58:28 -08:00
namespace.c mount: hold namespace_sem across copy in create_new_namespace() 2026-02-18 14:04:42 +01:00
nsfs.c mount: add OPEN_TREE_NAMESPACE 2026-01-16 19:21:40 +01:00
nullfs.c fs: add immutable rootfs 2026-01-12 16:52:09 +01:00
open.c struct filename series 2026-02-09 16:58:28 -08:00
pidfs.c pidfs: protect PIDFD_GET_* ioctls() via ifdef 2026-01-06 23:08:12 +01:00
pipe.c Summary 2025-12-05 11:15:37 -08:00
pnode.c umount_tree(): take all victims out of propagation graph at once 2025-09-15 21:26:44 -04:00
pnode.h umount_tree(): take all victims out of propagation graph at once 2025-09-15 21:26:44 -04:00
posix_acl.c posix_acl: make posix_acl_to_xattr() alloc the buffer 2026-01-16 10:51:12 +01:00
proc_namespace.c
read_write.c fs: add setlease to generic_ro_fops and read-only filesystem directory operations 2026-01-12 10:55:45 +01:00
readdir.c readdir: require opt-in for d_type flags 2026-01-12 10:57:34 +01:00
remap_range.c
select.c select: store end_time as timespec64 in restart block 2025-12-24 14:01:57 +01:00
seq_file.c kernel.h: drop hex.h and update all hex.h users 2026-01-20 19:44:19 -08:00
signalfd.c signalfd: convert do_signalfd4() to FD_ADD() 2025-11-28 12:42:32 +01:00
splice.c fs: use min() or umin() instead of min_t() 2025-12-15 14:33:37 +01:00
stack.c
stat.c statx: switch to CLASS(filename_maybe_null) 2026-01-16 12:52:04 -05:00
statfs.c user_statfs(): switch to CLASS(filename) 2026-01-16 12:52:04 -05:00
super.c \n 2026-02-12 10:52:46 -08:00
sync.c mm.git review status for linus..mm-stable 2026-02-12 11:32:37 -08:00
sysctls.c
timerfd.c timerfd: convert timerfd_create() to FD_ADD() 2025-11-28 12:42:32 +01:00
userfaultfd.c Significant patch series in this merge are as follows: 2025-12-05 13:52:43 -08:00
utimes.c do_utimes_path(): switch to CLASS(filename_uflags) 2026-01-16 12:52:03 -05:00
xattr.c filename_...xattr(): don't consume filename reference 2026-01-16 12:52:03 -05:00