Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7a2e8a8f authored by Valerie Aurora's avatar Valerie Aurora Committed by Linus Torvalds
Browse files

VFS: Sanity check mount flags passed to change_mnt_propagation() 



Sanity check the flags passed to change_mnt_propagation().  Exactly
one flag should be set.  Return EINVAL otherwise.

Userspace can pass in arbitrary combinations of MS_* flags to mount().
do_change_type() is called if any of MS_SHARED, MS_PRIVATE, MS_SLAVE,
or MS_UNBINDABLE is set.  do_change_type() clears MS_REC and then
calls change_mnt_propagation() with the rest of the user-supplied
flags.  change_mnt_propagation() clearly assumes only one flag is set
but do_change_type() does not check that this is true.  For example,
mount() with flags MS_SHARED | MS_RDONLY does not actually make the
mount shared or read-only but does clear MNT_UNBINDABLE.

Signed-off-by: default avatarValerie Aurora <vaurora@redhat.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 2bfc96a1

fs/namespace.c

+22 −1
Original line number Original line Diff line number Diff line
@@ -1483,6 +1483,23 @@ out_unlock: 
	return err;

	return err;

}

}





/*

 * Sanity check the flags to change_mnt_propagation.

 */



static int flags_to_propagation_type(int flags)

{

	int type = flags & ~MS_REC;



	/* Fail if any non-propagation flags are set */

	if (type & ~(MS_SHARED | MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE))

		return 0;

	/* Only one propagation flag should be set */

	if (!is_power_of_2(type))

		return 0;

	return type;

}



/*

/*

 * recursively change the type of the mountpoint.

 * recursively change the type of the mountpoint.

 */

 */
@@ -1490,7 +1507,7 @@ static int do_change_type(struct path *path, int flag) 
{

{

	struct vfsmount *m, *mnt = path->mnt;

	struct vfsmount *m, *mnt = path->mnt;

	int recurse = flag & MS_REC;

	int recurse = flag & MS_REC;

	int type = flag & ~MS_REC;

	int type;

	int err = 0;

	int err = 0;





	if (!capable(CAP_SYS_ADMIN))

	if (!capable(CAP_SYS_ADMIN))
@@ -1499,6 +1516,10 @@ static int do_change_type(struct path *path, int flag) 
	if (path->dentry != path->mnt->mnt_root)

	if (path->dentry != path->mnt->mnt_root)

		return -EINVAL;

		return -EINVAL;





	type = flags_to_propagation_type(flag);

	if (!type)

		return -EINVAL;



	down_write(&namespace_sem);

	down_write(&namespace_sem);

	if (type == MS_SHARED) {

	if (type == MS_SHARED) {

		err = invent_group_ids(mnt, recurse);

		err = invent_group_ids(mnt, recurse);