Re: [syzbot] [ntfs3?] KASAN: slab-use-after-free Read in chrdev_open

[Hillf Danton]

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git  83a7eefedc9b

diff -pur b/fs/namespace.c a/fs/namespace.c
--- b/fs/namespace.c	2024-06-17 18:24:14.364221500 +0800
+++ a/fs/namespace.c	2024-06-17 18:19:58.988799600 +0800
@@ -672,6 +672,14 @@ static bool legitimize_mnt(struct vfsmou
 	return false;
 }
 
+bool mnt_doomed(struct vfsmount *mnt)
+{
+	if (mnt->mnt_flags & MNT_DOOMED)
+		return true;
+
+	return 2 > mnt_get_count(real_mount(mnt));
+}
+
 /**
  * __lookup_mnt - find first child mount
  * @mnt:	parent mount
diff -pur b/fs/open.c a/fs/open.c
--- b/fs/open.c	2024-06-17 18:23:56.967279000 +0800
+++ a/fs/open.c	2024-06-17 18:22:11.065932700 +0800
@@ -952,6 +952,9 @@ static int do_dentry_open(struct file *f
 	if (!open)
 		open = f->f_op->open;
 	if (open) {
+		error = -ENODEV;
+		if (mnt_doomed(f->f_path.mnt))
+			goto cleanup_all;
 		error = open(inode, f);
 		if (error)
 			goto cleanup_all;
diff -pur b/include/linux/mount.h a/include/linux/mount.h
--- b/include/linux/mount.h	2024-06-17 18:25:07.750059900 +0800
+++ a/include/linux/mount.h	2024-06-17 18:17:35.669341200 +0800
@@ -93,6 +93,7 @@ extern bool mnt_may_suid(struct vfsmount
 extern struct vfsmount *clone_private_mount(const struct path *path);
 int mnt_get_write_access(struct vfsmount *mnt);
 void mnt_put_write_access(struct vfsmount *mnt);
+bool mnt_doomed(struct vfsmount *mnt);
 
 extern struct vfsmount *fc_mount(struct fs_context *fc);
 extern struct vfsmount *vfs_create_mount(struct fs_context *fc);
--