Re: [PATCH] fs/namespace.c: fix use-after-free of mount in mnt_warn_timestamp_expiry()

[Eric Biggers]

On Sun, Oct 13, 2019 at 07:04:10PM -0700, Deepa Dinamani wrote:
> Thanks for the fix.
> 
> Would it be better to move the check and warning to a place where the
> access is still safe?
> 
> -Deepa

True, we could just do

diff --git a/fs/namespace.c b/fs/namespace.c
index fe0e9e1410fe..9f2ceb542f05 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -2764,14 +2764,14 @@ static int do_new_mount_fc(struct fs_context *fc, struct path *mountpoint,
 	if (IS_ERR(mnt))
 		return PTR_ERR(mnt);
 
+	mnt_warn_timestamp_expiry(mountpoint, mnt);
+
 	error = do_add_mount(real_mount(mnt), mountpoint, mnt_flags);
 	if (error < 0) {
 		mntput(mnt);
 		return error;
 	}
 
-	mnt_warn_timestamp_expiry(mountpoint, mnt);
-
 	return error;
 }

But then the warning ("Mounted %s file system ...") is printed even if
do_add_mount() fails so nothing was actually mounted.

Though, it's just a warning message and I think failures here are rare, so maybe
we don't care.  Al, what do you think?

- Eric