Re: KASAN: use-after-free Read in mnt_warn_timestamp_expiry

From: Al Viro
Date: Wed Oct 16 2019 - 21:59:12 EST


On Wed, Oct 16, 2019 at 06:47:55PM -0700, Eric Biggers wrote:
> On Wed, Oct 16, 2019 at 06:42:11PM -0700, syzbot wrote:
> > ==================================================================
> > BUG: KASAN: use-after-free in mnt_warn_timestamp_expiry+0x4a/0x250
> > fs/namespace.c:2471
> > Read of size 8 at addr ffff888099937328 by task syz-executor.1/18510
> >
>
> Looks like a duplicate of this:
>
> #syz dup: KASAN: use-after-free Read in do_mount
>
> See the existing thread and proposed fix here:
> https://lkml.kernel.org/linux-fsdevel/000000000000805e5505945a234b@xxxxxxxxxx/T/#u

FWIW, I'd go with your "move mnt_warn_timestamp_expiry() up". However,
I'd probably turn the message into something like
foofs filesystem getting mounted at /mnt/barf supports...
And s/mounted/reconfigured/ if mnt_has_parent(mnt) is already true.

Objections?

Al, currently experiencing the joy of being ears-deep in 5 different shitpiles
simultaneously...