Received: by 2002:a25:683:0:0:0:0:0 with SMTP id 125csp771978ybg; Wed, 10 Jun 2020 13:18:49 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzlfRP6d4SZcdguJU1SVvTBQh9v4c7mlpAfqwcHtbhUD4l0ba4yOWDrWlGKL5xMCulgjSjB X-Received: by 2002:aa7:da03:: with SMTP id r3mr4073319eds.158.1591820329130; Wed, 10 Jun 2020 13:18:49 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1591820329; cv=none; d=google.com; s=arc-20160816; b=oK5d8vQHCPA4w54jthie2KsGYH8hs+1skxtnlo0o/2UrO1aCM9MdR9/FYWbwCECRNx tcI11jB8CobtDp3iJqHV28BMOahHIbxJkQy/H7JnlywRZR7rITlbbdy1KxPsyGZGJTHG mKo8SyugAxvLADEDZtOdZ+0Ina7BU0wfBmJbKHiIpa2sMBNn6dgnlBWfdrN9xIzlItLr TqEHrKEAZ6JVkLNeKIbd2yaN95twQ0Z9+74kMVLFHGwa72mbDGONDsUJwS0Khq4NnS14 n5TpfWd3927i/1yKVAgugJkTfzwaZkGnOIxhRwCCpiiv/sjAnjqWId2aEboiuHQPV6Zw 6vDA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from; bh=yV93mDDpnH3B8bs2xfTMcBIAupp894y75/vaiarzXPU=; b=wT6uAUX2dezTC+xHznbPJdYqPshFKjHMIj9SKAZsyAKYdiscUix18p7w8E+1maCBrz +1vct868a1ORPblSvhOLa9NLwFIv5lUlCc2toEtny0rBd7MLRaLRwNXNz581lMGL1WQx 8or1vHH6sPbZJjiRMehaWLtnGUTNiETyhNuO2p2tG2p1FKJbg8giDut5yi1MIE7IxHib 37oeL37AFvIxgnSGf+73F7upkAmujr5ZGov/kiTZX1Zx5hydxSzmXqYGsy5rdqp2RU8K x6gebnlyAEkG3UFZmppufDuANClPcNy1XvplaybMKawwm+yovuz9YzFQPg0fMo1FBJnN x1JQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id di14si356072edb.559.2020.06.10.13.18.26; Wed, 10 Jun 2020 13:18:49 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729139AbgFJShP (ORCPT + 99 others); Wed, 10 Jun 2020 14:37:15 -0400 Received: from raptor.unsafe.ru ([5.9.43.93]:53430 "EHLO raptor.unsafe.ru" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726287AbgFJShP (ORCPT ); Wed, 10 Jun 2020 14:37:15 -0400 Received: from comp-core-i7-2640m-0182e6.redhat.com (ip-89-102-33-211.net.upcbroadband.cz [89.102.33.211]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (No client certificate requested) by raptor.unsafe.ru (Postfix) with ESMTPSA id BA90E203BD; Wed, 10 Jun 2020 18:37:12 +0000 (UTC) From: Alexey Gladkov To: ebiederm@xmission.com Cc: syzbot , adobriyan@gmail.com, keescook@chromium.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com, viro@zeniv.linux.org.uk Subject: [PATCH v2] proc: s_fs_info may be NULL when proc_kill_sb is called Date: Wed, 10 Jun 2020 20:35:49 +0200 Message-Id: <20200610183549.1234214-1-gladkov.alexey@gmail.com> X-Mailer: git-send-email 2.25.4 In-Reply-To: <20200610130422.1197386-1-gladkov.alexey@gmail.com> References: <20200610130422.1197386-1-gladkov.alexey@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.6.1 (raptor.unsafe.ru [5.9.43.93]); Wed, 10 Jun 2020 18:37:13 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org syzbot found that proc_fill_super() fails before filling up sb->s_fs_info, deactivate_locked_super() will be called and sb->s_fs_info will be NULL. The proc_kill_sb() does not expect fs_info to be NULL which is wrong. Link: https://lore.kernel.org/lkml/0000000000002d7ca605a7b8b1c5@google.com Reported-by: syzbot+4abac52934a48af5ff19@syzkaller.appspotmail.com Fixes: fa10fed30f25 ("proc: allow to mount many instances of proc in one pid namespace") Signed-off-by: Alexey Gladkov --- fs/proc/root.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/fs/proc/root.c b/fs/proc/root.c index ffebed1999e5..5e444d4f9717 100644 --- a/fs/proc/root.c +++ b/fs/proc/root.c @@ -264,11 +264,13 @@ static void proc_kill_sb(struct super_block *sb) { struct proc_fs_info *fs_info = proc_sb_info(sb); - if (fs_info->proc_self) - dput(fs_info->proc_self); + if (!fs_info) { + kill_anon_super(sb); + return; + } - if (fs_info->proc_thread_self) - dput(fs_info->proc_thread_self); + dput(fs_info->proc_self); + dput(fs_info->proc_thread_self); kill_anon_super(sb); put_pid_ns(fs_info->pid_ns); -- 2.25.4