[PATCH] fhandle: handle detached mounts in capable_wrt_mount()

[Guangshuo Li]

The change referenced by the Fixes tag protects the lockless read of
mount->mnt_ns in may_decode_fh() with an RCU read-side critical section.

That prevents the namespace object from being freed while it is being
used, but it does not guarantee that mount->mnt_ns is non-NULL. A mount
can be detached concurrently after is_mounted() has checked the field and
before capable_wrt_mount() reads it again.

If capable_wrt_mount() observes the detached state, it currently
dereferences the NULL namespace pointer while passing mnt_ns->user_ns to
ns_capable().

Treat a detached mount as not capable for this permission relaxation and
return false when the RCU-protected mnt_ns read yields NULL.

Fixes: 40ab6644b996 ("fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()")
Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>
---
 fs/fhandle.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/fhandle.c b/fs/fhandle.c
index 1ca7eb3a6cb5..d9de7210a411 100644
--- a/fs/fhandle.c
+++ b/fs/fhandle.c
@@ -295,6 +295,9 @@ static bool capable_wrt_mount(struct mount *mount)
 	 */
 	guard(rcu)();
 	mnt_ns = READ_ONCE(mount->mnt_ns);
+	if (!mnt_ns)
+		return false;
+
 	return ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN);
 }
 
-- 
2.43.0