Re: [PATCH] make new mount API honour SB_NOUSER (was Re: [PATCH] block: Avoid mounting the bdev pseudo-filesystem in userspace)

[Arefev]

02.06.2026 12:11, Jan Kara пишет:
> On Tue 02-06-26 03:04:44, Al Viro wrote:
> > one should *not* be allowed to mount one of those, new API or not.
> >
> > Reported-by: Denis Arefev <arefev@xxxxxxxxx>
> > Signed-off-by: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
> Won't it make sense to actually check fc->sb_flags before we call
> vfs_create_mount()? Otherwise it looks good to me.
>
> 								Honza

Hi all.

The sequence of system calls before the crash could be as follows:

fsopen("bdev", ...)
fsconfig(fd_fs, FSCONFIG_CMD_CREATE, 0,0,0)
fsmount(fd_fs, 0,0)
move_mount(fd_mnt, "", AT_FDCWD, "./file1", 0x46ul)

The system call executed at the time of the cras:

open("/dev/media0", ...);

Simplified stacktrace:

path_openat
|-> link_path_walk
   |-> walk_component
      |-> __lookup_slow
         |-> ld = inode->i_op->lookup(inode, dentry, flags);   <- Oops


Searching for possible solutions in the commit history yielded the 
following result:

commit fd3e007f6c6a0f677e4ee8aca4b9bab8ad6cab9a
commit 1a6e9e76b713d9632783efe78295ed3507fdad64
commit d6f2589ad561aa5fa39f347eca6942668b7560a1

Checking the fc->sb_flags flag before calling vfs_create_mount() is a 
great idea,
if it helps prevent crashes in two more file systems, 'sockfs' and 'pipefs'.

Best regards, Denis.
> > ---
> > [[ I still want to see the rest of the reproducer - report smells like a missing
> > d_can_lookup() somewhere, on top of fsmount(2) bug]]
> > diff --git a/fs/namespace.c b/fs/namespace.c
> > index fe919abd2f01..17777c837683 100644
> > --- a/fs/namespace.c
> > +++ b/fs/namespace.c
> > @@ -4499,6 +4499,10 @@ SYSCALL_DEFINE3(fsmount, int, fs_fd, unsigned int, flags,
> >   	new_mnt = vfs_create_mount(fc);
> >   	if (IS_ERR(new_mnt))
> >   		return PTR_ERR(new_mnt);
> > +	if (new_mnt->mnt_sb->s_flags & SB_NOUSER) {
> > +		mntput(new_mnt);
> > +		return -EINVAL;
> > +	}
> >   	new_mnt->mnt_flags = mnt_flags;
> >   
> >   	new_path.dentry = dget(fc->root);