• Andrii Nakryiko's avatar
    fs: fix NULL dereference due to data race in prepend_path() · 09cad075
    Andrii Nakryiko authored
    Fix data race in prepend_path() with re-reading mnt->mnt_ns twice
    without holding the lock.
    
    is_mounted() does check for NULL, but is_anon_ns(mnt->mnt_ns) might
    re-read the pointer again which could be NULL already, if in between
    reads one of kern_unmount()/kern_unmount_array()/umount_tree() sets
    mnt->mnt_ns to NULL.
    
    This is seen in production with the following stack trace:
    
      BUG: kernel NULL pointer dereference, address: 0000000000000048
      ...
      RIP: 0010:prepend_path.isra.4+0x1ce/0x2e0
      Call Trace:
        d_path+0xe6/0x150
        proc_pid_readlink+0x8f/0x100
        vfs_readlink+0xf8/0x110
        do_readlinkat+0xfd/0x120
        __x64_sys_readlinkat+0x1a/0x20
        do_syscall_64+0x42/0x110
        entry_SYSCALL_64_after_hwframe+0x44/0xa9
    
    Fixes: f2683bd8 ("[PATCH] fix d_absolute_path() interplay with fsmount()")
    Signed-off-by: default avatarAndrii Nakryiko <andrii@kernel.org>
    Reviewed-by: default avatarJosef Bacik <josef@toxicpanda.com>
    Cc: Alexander Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    09cad075
d_path.c 11.4 KB