From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f50.google.com (mail-qv1-f50.google.com [209.85.219.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6E9FC42314C for ; Wed, 1 Jul 2026 11:44:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.50 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782906286; cv=none; b=aMmmor757pR1Ntoauj6bCu2VusbA7WxZsQM5zjvPUZGzRSVbaN1K2Qu4CzB23613p040dHcOfLYQpX3nti/Wdq6uolYa8Z5O4Nt4Buul8bqMNEXUME4FESNEevzzhT6mzwOxNXeihnYJPOqD+VybsdCL6MQWEMrp7Ol+LHSupVA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782906286; c=relaxed/simple; bh=Bn7cpK7c9P1Ng+xQTLrX5oRSvaP7UkoJRFYhjK+iQcU=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=GP8fUwHULmg3joGecsQmG3gsGmAwFQo7eUj0fZbkRBfWsfQRCjgcxsBDvG1RHrijnnfztDWObEtVQt87nwgHtUAql4gBEzLJqpEBTOwBbD1HXsSrYQfk/jpeDwjcCV1Z3lasEX/H9uF/eytExq205GixaEUa2WGxeI3DTGX6vHs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=trailofbits.com; spf=pass smtp.mailfrom=trailofbits.com; dkim=pass (2048-bit key) header.d=trailofbits.com header.i=@trailofbits.com header.b=C0e0vY33; arc=none smtp.client-ip=209.85.219.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=trailofbits.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=trailofbits.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=trailofbits.com header.i=@trailofbits.com header.b="C0e0vY33" Received: by mail-qv1-f50.google.com with SMTP id 6a1803df08f44-8ef1dc934d1so4842496d6.0 for ; Wed, 01 Jul 2026 04:44:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=trailofbits.com; s=google; t=1782906282; x=1783511082; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=CWuXB5G6o/EOutDklrz0KDK/EngRzHI91oIWGAEJRck=; b=C0e0vY333zeAMCS/zM/pqIYUkT/ypLoAkXN5K7p8Sd3JoEhBloB5jC3LghM1QSXQ53 9v/SHNallheASGhxKVytCtMb5RzQxCr/z+JoeaW3Cn7xpeBBlNC5ewKyiDfA6KEXV3ng 8QEc1DuOO0Es0pbUn4FR5DeNdATltUAdi0shnf/eeM57mwBEDjatSQaNcaVQbmWeDDHl JER10VKk8fQF8KFQ20MTcP9TK9v02gKqj78yRWZwXHccz6oFQ02plz5WswNqCOqP5rWP 0LdKX9rZJONPayNPmWQuBmzK4U8ITV8FnwWf97bqDM+rEOCLj92O1wDrGESr6xf0HZwd 9ysw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782906282; x=1783511082; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=CWuXB5G6o/EOutDklrz0KDK/EngRzHI91oIWGAEJRck=; b=JUzTmpf1qHp33TR8RY+FBNuCjkQTJzy3xC+vp7ZCcm8DysYMt/iXM0Lm/xNnw3LQ5k trApKSJSg5G2oWBLqKBMS7pQvCNi5bXF7Zth6v53TF+Igi4ra0lnTIacR6MJAzOGRXhX MKZLoQ4/VDcqeDMUbmuCYl2j4IApVpqrN7o4/Ggokdw9xMAiPMpJHQMFa61wOd9ZqCZG pkrgbyIs6zZBcnMOpd+mMTGUjoF+o6fxUhViV65RMTauA8PJkTcSzfyBSrmbHjZ4WtYb hFdV8JLWv1ImnRzhf5WTyH16DSQUZeWLRIIuIRISjsmvm+S7s9XagZpMiM+aDt3Kwph7 rhfw== X-Forwarded-Encrypted: i=1; AHgh+Rq1F1LOYK0Boepq+ndOR0MFWhFmJ15NDbBG9vvER++V/Ujquathj8xg7aVQMy6BpjofR9vKYz0+xKzsCeA=@vger.kernel.org X-Gm-Message-State: AOJu0YzBq+JFkKSxOS7vWI4HcVSL8Tshz01o2A2oV+morVnxgKdKUqHY do7GXcosI+0uY8kUTOtwuEwWuWk3E/i/QwTbz3YAI4RnRh+0BwslyHvBcSMyzDkJJAU= X-Gm-Gg: AfdE7cnEDtefx6+/+ggCj9VmiGHfKsTh7dmy28YjxxJWpSoUtjVnbXjsjkzUj+AOI8u 1L938uw4nE7GwpE7/RAiQexPKe88HNm6Hw7ttFk+A+7k8zf4Qa+OnYuegFZhTQQ2xAmCTHbflY0 7t5IuQ4rZZ7HKQ+kOGEfTicJsW6bdqzrtosJUDyZCZZ/bxl4B3CGJ9+KuXKfWVEocrhlSkMx1YS uRhGik2XXN6Ji8hd2WWkOaOK4K8K9QUdIfQjRrBJnHQeNMtyjy6dsiyjozocMiaxctAt8bDK7DF BySxsfPJuJhw1WgJwH9Rx3LiTXL3cT1rJSFNaRMT9luMkGAU3a/0I9rTC+mruHxabeYHHl9/4vx YU+DHth2PFsy2dcV+mr0hIv78P2/x9GCGG1hfJ6EEKjGagLAvxbCfewerR5wETiZFHbRNZVuudG nISQLxQPUw9gM9Z+sU+A== X-Received: by 2002:a05:6214:4e90:b0:8e5:8d7b:5188 with SMTP id 6a1803df08f44-8f2526fa04emr73202606d6.9.1782906282086; Wed, 01 Jul 2026 04:44:42 -0700 (PDT) Received: from localhost ([146.190.222.192]) by smtp.gmail.com with UTF8SMTPSA id 6a1803df08f44-8f3611dec91sm19921376d6.29.2026.07.01.04.44.41 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 01 Jul 2026 04:44:41 -0700 (PDT) From: David Lee To: viro@zeniv.linux.org.uk, Christian Brauner , Jan Kara Cc: David Lee , Chuck Lever , Jeff Layton , Amir Goldstein , Jann Horn , Dominik 'Disconnect3d' Czarnota , linux-fsdevel@vger.kernel.org, linux-nfs@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH] fhandle: reject detached mounts in capable_wrt_mount() Date: Wed, 1 Jul 2026 11:44:28 +0000 Message-ID: <20260701114438.24431-1-david.lee@trailofbits.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The recent fhandle RCU fix moved the mount namespace capability check into capable_wrt_mount(), so a non-NULL mnt_namespace survives the ns_capable() dereference. The helper still assumes the later READ_ONCE(mount->mnt_ns) must be non-NULL because may_decode_fh() checked is_mounted() first. That assumption is not stable. A detached mount from open_tree(..., OPEN_TREE_CLONE) can be dissolved on fput while open_by_handle_at() is between those checks, and umount_tree() can clear mount->mnt_ns. If the helper observes NULL, it dereferences mnt_ns->user_ns and panics. Return false when the RCU read observes a detached mount. This keeps the relaxed permission path conservative: a mount no longer attached to a namespace cannot authorize open_by_handle_at() access. Fixes: 620c266f3949 ("fhandle: relax open_by_handle_at() permission checks") Cc: stable@vger.kernel.org Signed-off-by: David Lee Assisted-by: Codex:gpt-5 --- Bug found and triaged by David Lee from Trail of Bits. Trail of Bits has a minimal PoC that triggers this crash on a custom kernel build, which can be shared further if needed. fs/fhandle.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/fhandle.c b/fs/fhandle.c index 1ca7eb3a6cb5..f8829231e3d7 100644 --- a/fs/fhandle.c +++ b/fs/fhandle.c @@ -295,7 +295,7 @@ static bool capable_wrt_mount(struct mount *mount) */ guard(rcu)(); mnt_ns = READ_ONCE(mount->mnt_ns); - return ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN); + return mnt_ns && ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN); } static inline int may_decode_fh(struct handle_to_path_ctx *ctx, -- 2.43.0