Commit 7a2e8a8f authored by Valerie Aurora's avatar Valerie Aurora Committed by Linus Torvalds

VFS: Sanity check mount flags passed to change_mnt_propagation()

Sanity check the flags passed to change_mnt_propagation().  Exactly
one flag should be set.  Return EINVAL otherwise.

Userspace can pass in arbitrary combinations of MS_* flags to mount().
do_change_type() is called if any of MS_SHARED, MS_PRIVATE, MS_SLAVE,
or MS_UNBINDABLE is set.  do_change_type() clears MS_REC and then
calls change_mnt_propagation() with the rest of the user-supplied
flags.  change_mnt_propagation() clearly assumes only one flag is set
but do_change_type() does not check that this is true.  For example,
mount() with flags MS_SHARED | MS_RDONLY does not actually make the
mount shared or read-only but does clear MNT_UNBINDABLE.
Signed-off-by: default avatarValerie Aurora <vaurora@redhat.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 2bfc96a1
...@@ -1483,6 +1483,23 @@ static int graft_tree(struct vfsmount *mnt, struct path *path) ...@@ -1483,6 +1483,23 @@ static int graft_tree(struct vfsmount *mnt, struct path *path)
return err; return err;
} }
/*
* Sanity check the flags to change_mnt_propagation.
*/
static int flags_to_propagation_type(int flags)
{
int type = flags & ~MS_REC;
/* Fail if any non-propagation flags are set */
if (type & ~(MS_SHARED | MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE))
return 0;
/* Only one propagation flag should be set */
if (!is_power_of_2(type))
return 0;
return type;
}
/* /*
* recursively change the type of the mountpoint. * recursively change the type of the mountpoint.
*/ */
...@@ -1490,7 +1507,7 @@ static int do_change_type(struct path *path, int flag) ...@@ -1490,7 +1507,7 @@ static int do_change_type(struct path *path, int flag)
{ {
struct vfsmount *m, *mnt = path->mnt; struct vfsmount *m, *mnt = path->mnt;
int recurse = flag & MS_REC; int recurse = flag & MS_REC;
int type = flag & ~MS_REC; int type;
int err = 0; int err = 0;
if (!capable(CAP_SYS_ADMIN)) if (!capable(CAP_SYS_ADMIN))
...@@ -1499,6 +1516,10 @@ static int do_change_type(struct path *path, int flag) ...@@ -1499,6 +1516,10 @@ static int do_change_type(struct path *path, int flag)
if (path->dentry != path->mnt->mnt_root) if (path->dentry != path->mnt->mnt_root)
return -EINVAL; return -EINVAL;
type = flags_to_propagation_type(flag);
if (!type)
return -EINVAL;
down_write(&namespace_sem); down_write(&namespace_sem);
if (type == MS_SHARED) { if (type == MS_SHARED) {
err = invent_group_ids(mnt, recurse); err = invent_group_ids(mnt, recurse);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment