Thanks for the fix.
Would it be better to move the check and warning to a place where the
access is still safe?
-Deepa
> On Oct 9, 2019, at 12:19 AM, Eric Biggers <ebiggers@xxxxxxxxxx> wrote:
>
> From: Eric Biggers <ebiggers@xxxxxxxxxx>
On Wed, Oct 9, 2019 at 12:19 AM Eric Biggers <ebiggers@xxxxxxxxxx> wrote:
>
> From: Eric Biggers <ebiggers@xxxxxxxxxx>
>
> After do_add_mount() returns success, the caller doesn't hold a
> reference to the 'struct mount' anymore. So it's invalid to access it
> in mnt_warn_timestamp_expiry().
>
> Fix it by instead passing the super_block and the mnt_flags. It's safe
> to access the super_block because it's pinned by fs_context::root.
>
> Reported-by: syzbot+da4f525235510683d855@xxxxxxxxxxxxxxxxxxxxxxxxx
> Fixes: f8b92ba67c5d ("mount: Add mount warning for impending timestamp expiry")
> Signed-off-by: Eric Biggers <ebiggers@xxxxxxxxxx>
> ---
> fs/namespace.c | 15 +++++++--------
> 1 file changed, 7 insertions(+), 8 deletions(-)
>
> diff --git a/fs/namespace.c b/fs/namespace.c
> index fe0e9e1410fe..7ef8edaaed69 100644
> --- a/fs/namespace.c
> +++ b/fs/namespace.c
> @@ -2466,12 +2466,11 @@ static void set_mount_attributes(struct mount *mnt, unsigned int mnt_flags)
> unlock_mount_hash();
> }
>
> -static void mnt_warn_timestamp_expiry(struct path *mountpoint, struct vfsmount *mnt)
> +static void mnt_warn_timestamp_expiry(struct path *mountpoint,
> + struct super_block *sb, int mnt_flags)
> {
> - struct super_block *sb = mnt->mnt_sb;
> -
> - if (!__mnt_is_readonly(mnt) &&
> - (ktime_get_real_seconds() + TIME_UPTIME_SEC_MAX > sb->s_time_max)) {
> + if (!(mnt_flags & MNT_READONLY) && !sb_rdonly(sb) &&
> + (ktime_get_real_seconds() + TIME_UPTIME_SEC_MAX > sb->s_time_max)) {
> char *buf = (char *)__get_free_page(GFP_KERNEL);
> char *mntpath = buf ? d_path(mountpoint, buf, PAGE_SIZE) : ERR_PTR(-ENOMEM);
> struct tm tm;
> @@ -2512,7 +2511,7 @@ static int do_reconfigure_mnt(struct path *path, unsigned int mnt_flags)
> set_mount_attributes(mnt, mnt_flags);
> up_write(&sb->s_umount);
>
> - mnt_warn_timestamp_expiry(path, &mnt->mnt);
> + mnt_warn_timestamp_expiry(path, sb, mnt_flags);
>
> return ret;
> }
> @@ -2555,7 +2554,7 @@ static int do_remount(struct path *path, int ms_flags, int sb_flags,
> up_write(&sb->s_umount);
> }
>
> - mnt_warn_timestamp_expiry(path, &mnt->mnt);
> + mnt_warn_timestamp_expiry(path, sb, mnt_flags);
>
> put_fs_context(fc);
> return err;
> @@ -2770,7 +2769,7 @@ static int do_new_mount_fc(struct fs_context *fc, struct path *mountpoint,
> return error;
> }
>
> - mnt_warn_timestamp_expiry(mountpoint, mnt);
> + mnt_warn_timestamp_expiry(mountpoint, sb, mnt_flags);
>
> return error;
> }
> --
> 2.23.0
>
