Re: [syzbot] [ntfs3?] KASAN: slab-use-after-free Read in chrdev_open
From: Hillf Danton
Date: Mon Jun 17 2024 - 06:30:19 EST
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 83a7eefedc9b
diff -pur b/fs/namespace.c a/fs/namespace.c
--- b/fs/namespace.c 2024-06-17 18:24:14.364221500 +0800
+++ a/fs/namespace.c 2024-06-17 18:19:58.988799600 +0800
@@ -672,6 +672,14 @@ static bool legitimize_mnt(struct vfsmou
return false;
}
+bool mnt_doomed(struct vfsmount *mnt)
+{
+ if (mnt->mnt_flags & MNT_DOOMED)
+ return true;
+
+ return 2 > mnt_get_count(real_mount(mnt));
+}
+
/**
* __lookup_mnt - find first child mount
* @mnt: parent mount
diff -pur b/fs/open.c a/fs/open.c
--- b/fs/open.c 2024-06-17 18:23:56.967279000 +0800
+++ a/fs/open.c 2024-06-17 18:22:11.065932700 +0800
@@ -952,6 +952,9 @@ static int do_dentry_open(struct file *f
if (!open)
open = f->f_op->open;
if (open) {
+ error = -ENODEV;
+ if (mnt_doomed(f->f_path.mnt))
+ goto cleanup_all;
error = open(inode, f);
if (error)
goto cleanup_all;
diff -pur b/include/linux/mount.h a/include/linux/mount.h
--- b/include/linux/mount.h 2024-06-17 18:25:07.750059900 +0800
+++ a/include/linux/mount.h 2024-06-17 18:17:35.669341200 +0800
@@ -93,6 +93,7 @@ extern bool mnt_may_suid(struct vfsmount
extern struct vfsmount *clone_private_mount(const struct path *path);
int mnt_get_write_access(struct vfsmount *mnt);
void mnt_put_write_access(struct vfsmount *mnt);
+bool mnt_doomed(struct vfsmount *mnt);
extern struct vfsmount *fc_mount(struct fs_context *fc);
extern struct vfsmount *vfs_create_mount(struct fs_context *fc);
--