[PATCH 0/2] fs: two mount API fixes
From: fujo
Date: Wed Oct 21 2026 - 13:53:59 EST
Two mount API edge cases reported by shaos, both reproduced on
7.3.0-rc7 (58161ead2) with a small syscall probe run as /init under
QEMU with KASAN:
- statmount(2) with STATMOUNT_MNT_UIDMAP on a mount that is not
idmapped and a short buffer copied the reserved empty string at
offset 512, one byte past the declared bufsize, and returned
success.
- listmount(2) and listns(2) with a U64_MAX cursor wrapped around to
zero and restarted the enumeration at the first entry.
Probe output before:
uidmap buf=100 ret=0 size=101 byte512=0
lm cursor=MAX ret=1 id0=2147483651
ln cursor=MAX ret=8 id0=1 id1=2
after:
uidmap buf=100 ret=-75 (EOVERFLOW) byte512=170
lm cursor=MAX ret=-22 (EINVAL)
ln cursor=MAX ret=-22 (EINVAL)
The in-tree statmount_test (17/17), statmount_test_ns (2/2) and
listmount_test (2/2) pass with both patches applied.
Thanks,
fujo