| From 16a34adb9392b2fe4195267475ab5b472e55292c Mon Sep 17 00:00:00 2001 |
| From: Al Viro <viro@zeniv.linux.org.uk> |
| Date: Thu, 19 Apr 2018 22:03:08 -0400 |
| Subject: Don't leak MNT_INTERNAL away from internal mounts |
| |
| From: Al Viro <viro@zeniv.linux.org.uk> |
| |
| commit 16a34adb9392b2fe4195267475ab5b472e55292c upstream. |
| |
| We want it only for the stuff created by SB_KERNMOUNT mounts, *not* for |
| their copies. As it is, creating a deep stack of bindings of /proc/*/ns/* |
| somewhere in a new namespace and exiting yields a stack overflow. |
| |
| Cc: stable@kernel.org |
| Reported-by: Alexander Aring <aring@mojatatu.com> |
| Bisected-by: Kirill Tkhai <ktkhai@virtuozzo.com> |
| Tested-by: Kirill Tkhai <ktkhai@virtuozzo.com> |
| Tested-by: Alexander Aring <aring@mojatatu.com> |
| Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| fs/namespace.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| --- a/fs/namespace.c |
| +++ b/fs/namespace.c |
| @@ -944,7 +944,8 @@ static struct mount *clone_mnt(struct mo |
| goto out_free; |
| } |
| |
| - mnt->mnt.mnt_flags = old->mnt.mnt_flags & ~(MNT_WRITE_HOLD|MNT_MARKED); |
| + mnt->mnt.mnt_flags = old->mnt.mnt_flags; |
| + mnt->mnt.mnt_flags &= ~(MNT_WRITE_HOLD|MNT_MARKED|MNT_INTERNAL); |
| /* Don't allow unprivileged users to change mount flags */ |
| if (flag & CL_UNPRIVILEGED) { |
| mnt->mnt.mnt_flags |= MNT_LOCK_ATIME; |
