vfs: move_mount: reject moving kernel internal mounts
sys_move_mount() crashes by dereferencing the pointer MNT_NS_INTERNAL, a.k.a. ERR_PTR(-EINVAL), if the old mount is specified by fd for a kernel object with an internal mount, such as a pipe or memfd. Fix it by checking for this case and returning -EINVAL. [AV: what we want is is_mounted(); use that instead of making the condition even more convoluted] Reproducer: #include <unistd.h> #define __NR_move_mount 429 #define MOVE_MOUNT_F_EMPTY_PATH 0x00000004 int main() { int fds[2]; pipe(fds); syscall(__NR_move_mount, fds[0], "", -1, "/", MOVE_MOUNT_F_EMPTY_PATH); } Reported-by:<syzbot+6004acbaa1893ad013f0@syzkaller.appspotmail.com> Fixes: 2db154b3 ("vfs: syscall: Add move_mount(2) to move mounts around") Signed-off-by:
Eric Biggers <ebiggers@google.com> Signed-off-by:
Al Viro <viro@zeniv.linux.org.uk>
parent
d728cf79
Please register or sign in to comment