OSDN Git Service

fs/namespace.c: fix use-after-free of mount in mnt_warn_timestamp_expiry()
authorEric Biggers <ebiggers@google.com>
Thu, 17 Oct 2019 02:48:14 +0000 (19:48 -0700)
committerAl Viro <viro@zeniv.linux.org.uk>
Thu, 17 Oct 2019 03:15:09 +0000 (23:15 -0400)
commit0ecee66990644c3482209ff7c12faa7bc40449b1
treeb851ba3d0c8801481a22c73182ef338faef632d5
parent4f5cafb5cb8471e54afdc9054d973535614f7675
fs/namespace.c: fix use-after-free of mount in mnt_warn_timestamp_expiry()

After do_add_mount() returns success, the caller doesn't hold a
reference to the 'struct mount' anymore.  So it's invalid to access it
in mnt_warn_timestamp_expiry().

Fix it by calling mnt_warn_timestamp_expiry() before do_add_mount()
rather than after, and adjusting the warning message accordingly.

Reported-by: syzbot+da4f525235510683d855@syzkaller.appspotmail.com
Fixes: f8b92ba67c5d ("mount: Add mount warning for impending timestamp expiry")
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
fs/namespace.c