Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754545AbcDVPjE (ORCPT ); Fri, 22 Apr 2016 11:39:04 -0400 Received: from mail-oi0-f45.google.com ([209.85.218.45]:33391 "EHLO mail-oi0-f45.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754478AbcDVPi6 (ORCPT ); Fri, 22 Apr 2016 11:38:58 -0400 From: Seth Forshee To: "Eric W. Biederman" , Alexander Viro Cc: Serge Hallyn , Richard Weinberger , Austin S Hemmelgarn , Miklos Szeredi , Pavel Tikhomirov , linux-kernel@vger.kernel.org, linux-bcache@vger.kernel.org, dm-devel@redhat.com, linux-raid@vger.kernel.org, linux-mtd@lists.infradead.org, linux-fsdevel@vger.kernel.org, fuse-devel@lists.sourceforge.net, linux-security-module@vger.kernel.org, selinux@tycho.nsa.gov, cgroups@vger.kernel.org, Seth Forshee Subject: [PATCH v3 01/21] fs: fix a posible leak of allocated superblock Date: Fri, 22 Apr 2016 10:38:18 -0500 Message-Id: <1461339521-123191-2-git-send-email-seth.forshee@canonical.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1461339521-123191-1-git-send-email-seth.forshee@canonical.com> References: <1461339521-123191-1-git-send-email-seth.forshee@canonical.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1148 Lines: 36 From: Pavel Tikhomirov We probably need to fix superblock leak in patch (v4 "fs: Add user namesapace member to struct super_block"): Imagine posible code path in sget_userns: we iterate through type->fs_supers and do not find suitable sb, we drop sb_lock to allocate s and go to retry. After we dropped sb_lock some other task from different userns takes sb_lock, it is already in retry stage and has s allocated, so it puts its s in type->fs_supers list. So in retry we will find these sb in list and check it has a different userns, and finally we will return without freeing s. Signed-off-by: Pavel Tikhomirov Acked-by: Seth Forshee --- fs/super.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/super.c b/fs/super.c index 829841e0ae7e..092a7828442e 100644 --- a/fs/super.c +++ b/fs/super.c @@ -474,6 +474,10 @@ retry: continue; if (user_ns != old->s_user_ns) { spin_unlock(&sb_lock); + if (s) { + up_write(&s->s_umount); + destroy_super(s); + } return ERR_PTR(-EBUSY); } if (!grab_super(old)) -- 1.9.1