Re: [PATCH] fs: fix NULL dereference due to data race in prepend_path()

2020-10-14 Thread Josef Bacik
On 10/14/20 4:45 PM, Andrii Nakryiko wrote: Fix data race in prepend_path() with re-reading mnt->mnt_ns twice without holding the lock. is_mounted() does check for NULL, but is_anon_ns(mnt->mnt_ns) might re-read the pointer again which could be NULL already, if in between reads one of

Re: [PATCH] fs: fix NULL dereference due to data race in prepend_path()

2020-10-14 Thread Linus Torvalds
On Wed, Oct 14, 2020 at 4:09 PM Al Viro wrote: > > If you've already grabbed it, I'll just push a followup cleanup. Already grabbed (along with the ppc32 csum fix). Your suggested helper function cleanup sounds good. Linus

Re: [PATCH] fs: fix NULL dereference due to data race in prepend_path()

2020-10-14 Thread Al Viro
On Wed, Oct 14, 2020 at 01:45:28PM -0700, Andrii Nakryiko wrote: > Fix data race in prepend_path() with re-reading mnt->mnt_ns twice without > holding the lock. is_mounted() does check for NULL, but > is_anon_ns(mnt->mnt_ns) > might re-read the pointer again which could be NULL already, if in

Re: [PATCH] fs: fix NULL dereference due to data race in prepend_path()

2020-10-14 Thread Al Viro
On Wed, Oct 14, 2020 at 02:49:18PM -0700, Linus Torvalds wrote: > On Wed, Oct 14, 2020 at 2:40 PM Andrii Nakryiko wrote: > > > > Fix data race in prepend_path() with re-reading mnt->mnt_ns twice without > > holding the lock. is_mounted() does check for NULL, but > > is_anon_ns(mnt->mnt_ns) > >

Re: [PATCH] fs: fix NULL dereference due to data race in prepend_path()

2020-10-14 Thread Linus Torvalds
On Wed, Oct 14, 2020 at 2:40 PM Andrii Nakryiko wrote: > > Fix data race in prepend_path() with re-reading mnt->mnt_ns twice without > holding the lock. is_mounted() does check for NULL, but > is_anon_ns(mnt->mnt_ns) > might re-read the pointer again which could be NULL already, if in between >

Re: [PATCH] fs: fix NULL dereference due to data race in prepend_path()

2020-10-14 Thread Andrii Nakryiko
On Wed, Oct 14, 2020 at 4:08 PM Al Viro wrote: > > On Wed, Oct 14, 2020 at 01:45:28PM -0700, Andrii Nakryiko wrote: > > Fix data race in prepend_path() with re-reading mnt->mnt_ns twice without > > holding the lock. is_mounted() does check for NULL, but > > is_anon_ns(mnt->mnt_ns) > > might

[PATCH] fs: fix NULL dereference due to data race in prepend_path()

2020-10-14 Thread Andrii Nakryiko
Fix data race in prepend_path() with re-reading mnt->mnt_ns twice without holding the lock. is_mounted() does check for NULL, but is_anon_ns(mnt->mnt_ns) might re-read the pointer again which could be NULL already, if in between reads one of kern_unmount()/kern_unmount_array()/umount_tree() sets