Re: [PATCH 3/6] listmount: don't wrap around with a U64_MAX cursor

[Jeff Layton <jlayton@kernel.org>]

On Wed, 2026-10-21 at 13:46 +0200, Christian Brauner wrote:
> do_listmount() takes the last mount id the caller saw and looks up the
> first mount after it by searching for last_mnt_id + 1. With U64_MAX
> that wraps around to zero and the search finds the first mount in the
> namespace. So a cursor at the largest possible id restarts the listing
> from the beginning instead of ending it. A cursor of U64_MAX - 1
> correctly returns nothing.
> 
> No mount will ever have that id. Mount ids come from a counter that
> starts at MNT_UNIQUE_ID_OFFSET + 1 and a caller that only feeds back
> ids it got from us can't hit this. It's still wrong. Nothing can come
> after the largest possible id so return no entries for it, just like
> for any other cursor past the last mount.
> 
> The reverse direction isn't affected. A cursor of zero is special-cased
> and anything else is larger than MNT_UNIQUE_ID_OFFSET so last_mnt_id - 1
> can't underflow.
> 
> Reproducer, unprivileged:
> 
>     #define _GNU_SOURCE
>     #include <errno.h>
>     #include <stdint.h>
>     #include <stdio.h>
>     #include <sys/syscall.h>
>     #include <unistd.h>
>     #define LSMT_ROOT 0xffffffffffffffffULL
>     struct mnt_id_req {
>     	uint32_t size, mnt_ns_fd;
>     	uint64_t mnt_id, param, mnt_ns_id;
>     };
>     static void list(uint64_t cursor)
>     {
>     	struct mnt_id_req req = {
>     		.size = sizeof(req), .mnt_id = LSMT_ROOT, .param = cursor,
>     	};
>     	uint64_t ids[8];
>     	long ret;
>     	errno = 0;
>     	ret = syscall(__NR_listmount, &req, ids, 8, 0);
>     	printf("cursor %llu: ret %ld errno %d", (unsigned long long)cursor,
>     	       ret, errno);
>     	for (long i = 0; i < ret && i < 1; i++)
>     		printf("%s%llu", i ? "," : " ids ", (unsigned long long)ids[i]);
>     	printf("%s\n", ret > 1 ? ",..." : "");
>     }
>     int main(void)
>     {
>     	list(0);
>     	list(UINT64_MAX - 1);
>     	list(UINT64_MAX);
>     	return 0;
>     }
> 
> Before, on 7.3.0-rc7-00252-g4e3259b08c54 (vfs.fixes) in a VM:
> 
>     cursor 0: ret 5 errno 0 ids 2147483651,...
>     cursor 18446744073709551614: ret 0 errno 0
>     cursor 18446744073709551615: ret 5 errno 0 ids 2147483651,...
> 
> After:
> 
>     cursor 0: ret 5 errno 0 ids 2147483651,...
>     cursor 18446744073709551614: ret 0 errno 0
>     cursor 18446744073709551615: ret 0 errno 0
> 
> Reported-by: shaos <shawnq1@163.com>
> Link: https://lore.kernel.org/r/20261020110732.959552-1-shawnq1@163.com
> Fixes: b4c2bea8ceaa ("add listmount(2) syscall")
> Cc: stable@vger.kernel.org
> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
> ---
>  fs/namespace.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/fs/namespace.c b/fs/namespace.c
> index 6c9c0cdbe890..dd60123a0cb0 100644
> --- a/fs/namespace.c
> +++ b/fs/namespace.c
> @@ -6253,6 +6253,8 @@ static ssize_t do_listmount(struct klistmount *kls, bool reverse)
>  	} else {
>  		if (reverse)
>  			first = mnt_find_id_at_reverse(ns, last_mnt_id - 1);
> +		else if (last_mnt_id == U64_MAX)
> +			first = NULL; /* nothing comes after the largest id */
>  		else
>  			first = mnt_find_id_at(ns, last_mnt_id + 1);
>  	}

Reviewed-by: Jeff Layton <jlayton@kernel.org>