fs/fhandle.c: fix a race in call of has_locked_children()

commit 1f282cdc1d219c4a557f7009e81bc792820d9d9a upstream.

may_decode_fh() is calling has_locked_children() while holding no locks.
That's an oopsable race...

The rest of the callers are safe since they are holding namespace_sem and
are guaranteed a positive refcount on the mount in question.

Rename the current has_locked_children() to __has_locked_children(), make
it static and switch the fs/namespace.c users to it.

Make has_locked_children() a wrapper for __has_locked_children(), calling
the latter under read_seqlock_excl(&mount_lock).

Reviewed-by: Christian Brauner <brauner@kernel.org>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Fixes: 620c266f3949 ("fhandle: relax open_by_handle_at() permission checks")
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
[ Harshit: Resolved conflicts due to missing commit:
  db04662e2f4f ("fs: allow detached mounts in clone_private_mount()") in
  linux-6.12.y ]
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/namespace.c b/fs/namespace.c
index 962fda4fa2467ed2af435036a6e134b5cd058a54..c8519302f582405231481c4712d223103efd6e24 100644 (file)
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -2227,7 +2227,7 @@ void drop_collected_mounts(struct vfsmount *mnt)
        namespace_unlock();
 }
 
-bool has_locked_children(struct mount *mnt, struct dentry *dentry)
+static bool __has_locked_children(struct mount *mnt, struct dentry *dentry)
 {
        struct mount *child;
 
@@ -2241,6 +2241,16 @@ bool has_locked_children(struct mount *mnt, struct dentry *dentry)
        return false;
 }
 
+bool has_locked_children(struct mount *mnt, struct dentry *dentry)
+{
+       bool res;
+
+       read_seqlock_excl(&mount_lock);
+       res = __has_locked_children(mnt, dentry);
+       read_sequnlock_excl(&mount_lock);
+       return res;
+}
+
 /**
  * clone_private_mount - create a private clone of a path
  * @path: path to clone
@@ -2268,7 +2278,7 @@ struct vfsmount *clone_private_mount(const struct path *path)
                return ERR_PTR(-EPERM);
        }
 
-       if (has_locked_children(old_mnt, path->dentry))
+       if (__has_locked_children(old_mnt, path->dentry))
                goto invalid;
 
        new_mnt = clone_mnt(old_mnt, path->dentry, CL_PRIVATE);
@@ -2762,7 +2772,7 @@ static struct mount *__do_loopback(struct path *old_path, int recurse)
        if (!check_mnt(old) && old_path->dentry->d_op != &ns_dentry_operations)
                return mnt;
 
-       if (!recurse && has_locked_children(old, old_path->dentry))
+       if (!recurse && __has_locked_children(old, old_path->dentry))
                return mnt;
 
        if (recurse)
@@ -3152,7 +3162,7 @@ static int do_set_group(struct path *from_path, struct path *to_path)
                goto out;
 
        /* From mount should not have locked children in place of To's root */
-       if (has_locked_children(from, to->mnt.mnt_root))
+       if (__has_locked_children(from, to->mnt.mnt_root))
                goto out;
 
        /* Setting sharing groups is only allowed on private mounts */