Re: [PATCH] fs/namespace.c: fix use-after-free of mount in mnt_warn_timestamp_expiry()

[Eric Biggers]

On Sun, Oct 13, 2019 at 07:04:10PM -0700, Deepa Dinamani wrote:
> Thanks for the fix.
> 
> Would it be better to move the check and warning to a place where the
> access is still safe?
> 
> -Deepa

True, we could just do

diff --git a/fs/namespace.c b/fs/namespace.c
index fe0e9e1410fe..9f2ceb542f05 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -2764,14 +2764,14 @@ static int do_new_mount_fc(struct fs_context *fc, 
struct path *mountpoint,
        if (IS_ERR(mnt))
                return PTR_ERR(mnt);
 
+       mnt_warn_timestamp_expiry(mountpoint, mnt);
+
        error = do_add_mount(real_mount(mnt), mountpoint, mnt_flags);
        if (error < 0) {
                mntput(mnt);
                return error;
        }
 
-       mnt_warn_timestamp_expiry(mountpoint, mnt);
-
        return error;
 }

But then the warning ("Mounted %s file system ...") is printed even if
do_add_mount() fails so nothing was actually mounted.

Though, it's just a warning message and I think failures here are rare, so maybe
we don't care.  Al, what do you think?

- Eric