Re: [PATCH] fhandle: handle detached mounts in capable_wrt_mount()

[Christian Brauner]

> The change referenced by the Fixes tag protects the lockless read of
> mount->mnt_ns in may_decode_fh() with an RCU read-side critical section.
> 
> That prevents the namespace object from being freed while it is being
> used, but it does not guarantee that mount->mnt_ns is non-NULL. A mount
> can be detached concurrently after is_mounted() has checked the field and
> before capable_wrt_mount() reads it again.
> 
> If capable_wrt_mount() observes the detached state, it currently
> dereferences the NULL namespace pointer while passing mnt_ns->user_ns to
> ns_capable().
> 
> Treat a detached mount as not capable for this permission relaxation and
> return false when the RCU-protected mnt_ns read yields NULL.
> 
> Fixes: 40ab6644b996 ("fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()")
> Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>

That's already fixed upstream.

--