From patchwork Tue Jul 31 07:29:28 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrey Vagin X-Patchwork-Id: 10550319 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 0403B13BF for ; Tue, 31 Jul 2018 07:29:46 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id DD4272A678 for ; Tue, 31 Jul 2018 07:29:45 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id D18E42A6A9; Tue, 31 Jul 2018 07:29:45 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 3D1BD2A69B for ; Tue, 31 Jul 2018 07:29:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727455AbeGaJIl (ORCPT ); Tue, 31 Jul 2018 05:08:41 -0400 Received: from mail-lf1-f68.google.com ([209.85.167.68]:34434 "EHLO mail-lf1-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727132AbeGaJIl (ORCPT ); Tue, 31 Jul 2018 05:08:41 -0400 Received: by mail-lf1-f68.google.com with SMTP id n96-v6so9998045lfi.1 for ; Tue, 31 Jul 2018 00:29:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:from:to:cc:subject:date:message-id; bh=GZs06UM4nUEOFhyRulotWVMtqTe8QHmDYCgJVWMD8GE=; b=MNslbNHy3aL/4EfUq1iJG7lr1QIj8s1YtL+KeUJ73tACbXvpx8eq3SDeujAik31g8a +5EPr7szcxoLK0/quQ+WT9nuKdf2gOWRj4XtqN3EzRYl0Zi9u/HdNsV4cSXT+aw61P30 fouS1+TBvU9/4HprLAqjR1oNKwxkxi/5yWCszjLBDk2bvd9lOB3N3J0NDdlZ8Bl8Qmt5 QEbsfqzHs+FQWuUhm5JYveTaws16hwigGV97MRmBqW3v4CPJOoquZ3fjERi6dCd31MU7 StL0Kjd3MydrA1g8pSVCLfjuWrPKZsl3Zh0aNUPJLFXbu8ZhA9QravPq2xbELDnccZLw kGpw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id; bh=GZs06UM4nUEOFhyRulotWVMtqTe8QHmDYCgJVWMD8GE=; b=rwmkzftWkub77TfrXWtzLSipwKU6CsT/4rCuNqXdGzvWcLP7NfqFoUqKJTzeL0Xuc4 9wiqUugsu6SnJ5WHkt91iO/qA+W6OiWLLC3U439L/F1yWZmikOB/qR8yrom4kWAmwblu dkDuQ++mGr2xwO5G2GozUTCXA/O2Tv82tlLETnYbg3bKXjzGTkXNVQy8/gW+3Npj7nQ5 qE6dUp4bFMVQAf/mjXFxNw7jU/AKgCdws4iiZ3SaWHXGlPG4riOng9ApHPkJxalqPem0 ytGBm+NC7tCKZ5igErsh/V0Zai0zjZ96Tj0ToYZRPHaN28q/wu2xyRJuqU1jfZwzlFnF ozeg== X-Gm-Message-State: AOUpUlELKPuB2JLTPhknNRB+npF5wDRM4YVXmtiUXBwEgyYNXXv7GsOC ikvct1rZYrLGP+bcfPriDuA= X-Google-Smtp-Source: AAOMgpdWo2kJbPQqMsLG4HtcU0SlkOiTVO/zVlR/rAywZCEZNgq9lFkZeOvfpB3IRj3ORZnIh6M+Og== X-Received: by 2002:a19:5c8c:: with SMTP id u12-v6mr12671643lfi.98.1533022182429; Tue, 31 Jul 2018 00:29:42 -0700 (PDT) Received: from laptop.sw.ru (c-73-140-212-29.hsd1.wa.comcast.net. [73.140.212.29]) by smtp.gmail.com with ESMTPSA id b24-v6sm219566lji.13.2018.07.31.00.29.40 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Tue, 31 Jul 2018 00:29:41 -0700 (PDT) From: Andrei Vagin To: David Howells Cc: linux-fsdevel@vger.kernel.org, Andrei Vagin Subject: [PATCH dhowells/mount-context] fs: don't call fs_context->free() from fsmount() Date: Tue, 31 Jul 2018 00:29:28 -0700 Message-Id: <20180731072928.2413-1-avagin@openvz.org> X-Mailer: git-send-email 2.17.1 Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Andrei Vagin fs_context->free() will be called from fscontext_release(). Without this patch, a kernel bug is triggered: BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 PGD 800000012b0a3067 P4D 800000012b0a3067 PUD 131f1a067 PMD 0 Oops: 0000 [#1] SMP PTI CPU: 0 PID: 612 Comm: test Not tainted 4.18.0-rc1-00037-g60023faf445f #12 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20180531_142017-buildhw-08.phx2.fedoraproject.org-1.fc28 04/01/2014 RIP: 0010:proc_fs_context_free+0xd/0x30 Code: 78 dd ff b8 ea ff ff ff eb af e8 fe dd d5 ff 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 53 48 8b 9f 90 00 00 00 <48> 8b 3b 48 85 ff 74 05 e8 16 24 e3 ff 48 89 df 5b e9 fd f5 f3 ff RSP: 0018:ffffa9b5c0b53e60 EFLAGS: 00010282 RAX: ffffffffaf332e20 RBX: 0000000000000000 RCX: 0000000000000005 RDX: ffff9bc77abbe1bc RSI: 0000000000000001 RDI: ffff9bc774209908 RBP: ffff9bc77abbe0c8 R08: 0000000000000000 R09: 0000000000000000 R10: ffff9bc77ac08d20 R11: ffffffffb1232378 R12: ffff9bc779af0f28 R13: 0000000000020003 R14: ffff9bc77aba9020 R15: ffff9bc773b6ab48 FS: 00007f725675a4c0(0000) GS:ffff9bc77fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000012b0c6003 CR4: 00000000003606f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: put_fs_context+0x4f/0x150 fscontext_release+0x21/0x30 __fput+0xc0/0x230 task_work_run+0xa1/0xd0 exit_to_usermode_loop+0xbb/0xc0 do_syscall_64+0x1e5/0x210 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f725627ff24 Code: eb 89 e8 0f f6 01 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 8b 05 2a e9 2c 00 48 63 ff 85 c0 75 13 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 44 f3 c3 66 90 48 83 ec 18 48 89 7c 24 08 e8 The following code can be used to reproduce the bug. int main() { int fsfd, dfd; fsfd = fsopen("proc", 0); if (fsfd < 0) return 1; if (fsconfig(fsfd, fsconfig_cmd_create, NULL, NULL, 0) < 0) return 1; dfd = fsmount(fsfd, 0, 0); if (dfd < 0) return 1; if (close(dfd) < 0) return 1; if (close(fsfd) < 0) return 1; return 0; } Signed-off-by: Andrei Vagin --- fs/namespace.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/fs/namespace.c b/fs/namespace.c index 7e7b1145d15d..1899456194c3 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -3435,9 +3435,6 @@ SYSCALL_DEFINE3(fsmount, int, fs_fd, unsigned int, flags, unsigned int, ms_flags * do any memory allocation or anything like that at this point as we * don't want to have to handle any errors incurred. */ - if (fc->ops && fc->ops->free) - fc->ops->free(fc); - fc->fs_private = NULL; fc->s_fs_info = NULL; fc->sb_flags = 0; fc->sloppy = false;