The change referenced by the Fixes tag protects the lockless read of mount->mnt_ns in may_decode_fh() with an RCU read-side critical section. That prevents the namespace object from being freed while it is being used, but it does not guarantee that mount->mnt_ns is non-NULL. A mount can be detached concurrently after is_mounted() has checked the field and before capable_wrt_mount() reads it again. If capable_wrt_mount() observes the detached state, it currently dereferences the NULL namespace pointer while passing mnt_ns->user_ns to ns_capable(). Treat a detached mount as not capable for this permission relaxation and return false when the RCU-protected mnt_ns read yields NULL. Fixes: 40ab6644b996 ("fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()") Signed-off-by: Guangshuo Li --- fs/fhandle.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/fhandle.c b/fs/fhandle.c index 1ca7eb3a6cb5..d9de7210a411 100644 --- a/fs/fhandle.c +++ b/fs/fhandle.c @@ -295,6 +295,9 @@ static bool capable_wrt_mount(struct mount *mount) */ guard(rcu)(); mnt_ns = READ_ONCE(mount->mnt_ns); + if (!mnt_ns) + return false; + return ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN); } -- 2.43.0