Commit d4d49cb1 authored Apr 19, 2018 by Al Viro Committed by Greg Kroah-Hartman Apr 24, 2018

Don't leak MNT_INTERNAL away from internal mounts



commit 16a34adb9392b2fe4195267475ab5b472e55292c upstream.

We want it only for the stuff created by SB_KERNMOUNT mounts, *not* for
their copies.  As it is, creating a deep stack of bindings of /proc/*/ns/*
somewhere in a new namespace and exiting yields a stack overflow.

Cc: stable@kernel.org
Reported-by: Alexander Aring <aring@mojatatu.com>
Bisected-by: Kirill Tkhai <ktkhai@virtuozzo.com>
Tested-by: Kirill Tkhai <ktkhai@virtuozzo.com>
Tested-by: Alexander Aring <aring@mojatatu.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 08512557

fs/namespace.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -1089,7 +1089,8 @@ static struct mount clone_mnt(struct mount old, struct dentry *root,
		goto out_free;
		}

		mnt->mnt.mnt_flags = old->mnt.mnt_flags & ~(MNT_WRITE_HOLD\|MNT_MARKED);
		mnt->mnt.mnt_flags = old->mnt.mnt_flags;
		mnt->mnt.mnt_flags &= ~(MNT_WRITE_HOLD\|MNT_MARKED\|MNT_INTERNAL);
		/* Don't allow unprivileged users to change mount flags */
		if (flag & CL_UNPRIVILEGED) {
		mnt->mnt.mnt_flags \|= MNT_LOCK_ATIME;