Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1031555AbbD2CgU (ORCPT <rfc822;w@1wt.eu>);
	Tue, 28 Apr 2015 22:36:20 -0400
Received: from zeniv.linux.org.uk ([195.92.253.2]:45073 "EHLO
	ZenIV.linux.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1031333AbbD2CgQ (ORCPT
	<rfc822;linux-kernel@vger.kernel.org>);
	Tue, 28 Apr 2015 22:36:16 -0400
Date: Wed, 29 Apr 2015 03:36:13 +0100
From: Al Viro <viro@ZenIV.linux.org.uk>
To: Leon Ma <xindong.ma@intel.com>
Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] Validate pointer when copying mount namespace.
Message-ID: <20150429023613.GM889@ZenIV.linux.org.uk>
References: <y>
 <1430272604-6701-1-git-send-email-xindong.ma@intel.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <1430272604-6701-1-git-send-email-xindong.ma@intel.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
Content-Length: 1053
Lines: 24

On Wed, Apr 29, 2015 at 09:56:43AM +0800, Leon Ma wrote:
> We encountered following panic. Validate the pointer to avoid this.

> @@ -2788,7 +2788,7 @@ struct mnt_namespace *copy_mnt_ns(unsigned long flags, struct mnt_namespace *ns,
>  		q = next_mnt(q, new);
>  		if (!q)
>  			break;
> -		while (p->mnt.mnt_root != q->mnt.mnt_root)
> +		while (p && p->mnt.mnt_root != q->mnt.mnt_root)
>  			p = next_mnt(p, old);
>  	}
>  	namespace_unlock();

Details, please.  How do you reproduce that behaviour?  

I don't like that loop in its current form (it relies upon _not_ encountering
the same ->mnt_root in the parts of tree we hadn't copied), but your change
doesn't make it any better.  Seeing a reproducer would be useful in sorting
it out; in this form the patch papers over the bug rather than fixing it.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/