fs/namespace.c: fix mountpoint reference counter race
authorPiotr Krysiuk <piotras@gmail.com>
Mon, 27 Apr 2020 10:34:12 +0000 (11:34 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 2 May 2020 15:24:20 +0000 (17:24 +0200)
commite21c8c03af20932c15d8b1d3bb9cbad9607a6eab
tree5e75293578edcf86e8d7fe7830ff5fa56f17b9d6
parenta2dad369d0ee4c78467163c6a4a22f5b026e991d
fs/namespace.c: fix mountpoint reference counter race

A race condition between threads updating mountpoint reference counter
affects longterm releases 4.4.220, 4.9.220, 4.14.177 and 4.19.118.

The mountpoint reference counter corruption may occur when:
* one thread increments m_count member of struct mountpoint
  [under namespace_sem, but not holding mount_lock]
    pivot_root()
* another thread simultaneously decrements the same m_count
  [under mount_lock, but not holding namespace_sem]
    put_mountpoint()
      unhash_mnt()
        umount_mnt()
          mntput_no_expire()

To fix this race condition, grab mount_lock before updating m_count in
pivot_root().

Reference: CVE-2020-12114
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Piotr Krysiuk <piotras@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/namespace.c