Messages in this thread Patch in this message | | | Date | Thu, 19 Apr 2018 17:44:24 +0100 | From | Al Viro <> | Subject | Re: [bisected] Stack overflow after fs: "switch the IO-triggering parts of umount to fs_pin" (was net namespaces kernel stack overflow) |
| |
On Thu, Apr 19, 2018 at 04:34:48PM +0100, Al Viro wrote:
> IOW, we only get there if our vfsmount was an MNT_INTERNAL one. > So we have mnt->mnt_umount of some MNT_INTERNAL mount found in > ->mnt_pins of some other mount. Which, AFAICS, means that > it used to be mounted on that other mount. How the hell can > that happen? > > It looks like you somehow get a long chain of MNT_INTERNAL mounts > stacked on top of each other, which ought to be prevented by > mnt_flags &= ~MNT_INTERNAL_FLAGS; > in do_add_mount(). Nuts...
Arrrrrgh... Nuts is right - clone_mnt() preserves the sodding MNT_INTERNAL, with obvious results.
netns is related to the problem, by exposing MNT_INTERNAL mounts (in /proc/*/ns/*) for mount --bind to copy and attach to the tree. AFAICS, the minimal reproducer is
touch /tmp/a unshare -m sh -c 'for i in `seq 10000`; do mount --bind /proc/1/ns/net /tmp/a; done'
(and it can be anything in /proc/*/ns/*, really)
I think the fix should be along the lines of the following:
Don't leak MNT_INTERNAL away from internal mounts
We want it only for the stuff created by SB_KERNMOUNT mounts, *not* for their copies.
Cc: stable@kernel.org Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- diff --git a/fs/namespace.c b/fs/namespace.c --- a/fs/namespace.c +++ b/fs/namespace.c @@ -1089,7 +1089,8 @@ static struct mount *clone_mnt(struct mount *old, struct dentry *root, goto out_free; } - mnt->mnt.mnt_flags = old->mnt.mnt_flags & ~(MNT_WRITE_HOLD|MNT_MARKED); + mnt->mnt.mnt_flags = old->mnt.mnt_flags; + mnt->mnt.mnt_flags &= ~(MNT_WRITE_HOLD|MNT_MARKED|MNT_INTERNAL); /* Don't allow unprivileged users to change mount flags */ if (flag & CL_UNPRIVILEGED) { mnt->mnt.mnt_flags |= MNT_LOCK_ATIME;
| |