|
 |
b547181 |
From: "Eric W. Biederman" <ebiederm@xmission.com>
|
|
|
b547181 |
Date: Wed, 8 Oct 2014 10:42:27 -0700
|
|
|
b547181 |
Subject: [PATCH] mnt: Prevent pivot_root from creating a loop in the mount
|
|
|
b547181 |
tree
|
|
|
b547181 |
|
|
|
b547181 |
Andy Lutomirski recently demonstrated that when chroot is used to set
|
|
|
b547181 |
the root path below the path for the new ``root'' passed to pivot_root
|
|
|
b547181 |
the pivot_root system call succeeds and leaks mounts.
|
|
|
b547181 |
|
|
|
b547181 |
In examining the code I see that starting with a new root that is
|
|
|
b547181 |
below the current root in the mount tree will result in a loop in the
|
|
|
b547181 |
mount tree after the mounts are detached and then reattached to one
|
|
|
b547181 |
another. Resulting in all kinds of ugliness including a leak of that
|
|
|
b547181 |
mounts involved in the leak of the mount loop.
|
|
|
b547181 |
|
|
|
b547181 |
Prevent this problem by ensuring that the new mount is reachable from
|
|
|
b547181 |
the current root of the mount tree.
|
|
|
b547181 |
|
|
|
b547181 |
Upstream-status: Submitted for 3.18
|
|
|
b547181 |
Bugzilla: 1151095,1151484
|
|
|
b547181 |
|
|
|
b547181 |
Reported-by: Andy Lutomirski <luto@amacapital.net>
|
|
|
b547181 |
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
|
|
|
b547181 |
---
|
|
|
b547181 |
fs/namespace.c | 3 +++
|
|
|
b547181 |
1 file changed, 3 insertions(+)
|
|
|
b547181 |
|
|
|
b547181 |
diff --git a/fs/namespace.c b/fs/namespace.c
|
|
|
e241709 |
index 7f67b463a5b4..550dbff08677 100644
|
|
|
b547181 |
--- a/fs/namespace.c
|
|
|
b547181 |
+++ b/fs/namespace.c
|
|
|
e241709 |
@@ -2822,6 +2822,9 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
|
|
|
b547181 |
/* make sure we can reach put_old from new_root */
|
|
|
b547181 |
if (!is_path_reachable(old_mnt, old.dentry, &new))
|
|
|
b547181 |
goto out4;
|
|
|
b547181 |
+ /* make certain new is below the root */
|
|
|
b547181 |
+ if (!is_path_reachable(new_mnt, new.dentry, &root))
|
|
|
b547181 |
+ goto out4;
|
|
|
b547181 |
root_mp->m_count++; /* pin it so it won't go away */
|
|
|
b547181 |
lock_mount_hash();
|
|
|
b547181 |
detach_mnt(new_mnt, &parent_path);
|
|
|
b547181 |
--
|
|
|
b547181 |
1.9.3
|
|
|
b547181 |
|