4.4-stable patches

added patches:
	propagate_one-mnt_set_mountpoint-needs-mount_lock.patch

diff --git a/queue-4.4/propagate_one-mnt_set_mountpoint-needs-mount_lock.patch b/queue-4.4/propagate_one-mnt_set_mountpoint-needs-mount_lock.patch
new file mode 100644 (file)
index 0000000..02c6e3f
--- /dev/null
+++ b/queue-4.4/propagate_one-mnt_set_mountpoint-needs-mount_lock.patch
@@ -0,0 +1,46 @@
+From b0d3869ce9eeacbb1bbd541909beeef4126426d5 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Mon, 27 Apr 2020 10:26:22 -0400
+Subject: propagate_one(): mnt_set_mountpoint() needs mount_lock
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit b0d3869ce9eeacbb1bbd541909beeef4126426d5 upstream.
+
+... to protect the modification of mp->m_count done by it.  Most of
+the places that modify that thing also have namespace_lock held,
+but not all of them can do so, so we really need mount_lock here.
+Kudos to Piotr Krysiuk <piotras@gmail.com>, who'd spotted a related
+bug in pivot_root(2) (fixed unnoticed in 5.3); search for other
+similar turds has caught out this one.
+
+Cc: stable@kernel.org
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Piotr Krysiuk <piotras@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/pnode.c |    9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+--- a/fs/pnode.c
++++ b/fs/pnode.c
+@@ -268,14 +268,13 @@ static int propagate_one(struct mount *m
+       if (IS_ERR(child))
+               return PTR_ERR(child);
+       child->mnt.mnt_flags &= ~MNT_LOCKED;
++      read_seqlock_excl(&mount_lock);
+       mnt_set_mountpoint(m, mp, child);
++      if (m->mnt_master != dest_master)
++              SET_MNT_MARK(m->mnt_master);
++      read_sequnlock_excl(&mount_lock);
+       last_dest = m;
+       last_source = child;
+-      if (m->mnt_master != dest_master) {
+-              read_seqlock_excl(&mount_lock);
+-              SET_MNT_MARK(m->mnt_master);
+-              read_sequnlock_excl(&mount_lock);
+-      }
+       hlist_add_head(&child->mnt_hash, list);
+       return count_mounts(m->mnt_ns, child);
+ }

diff --git a/queue-4.4/series b/queue-4.4/series
index a68792e77a3096d18ca98aaf39a9e455a2f001df..3f231561565f0c99d50cf287323cf963eb0eb1ab 100644 (file)
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -67,3 +67,4 @@ ext4-protect-journal-inode-s-blocks-using-block_validity.patch
 ext4-don-t-perform-block-validity-checks-on-the-journal-inode.patch
 ext4-fix-block-validity-checks-for-journal-inodes-using-indirect-blocks.patch
 ext4-unsigned-int-compared-against-zero.patch
+propagate_one-mnt_set_mountpoint-needs-mount_lock.patch