From 02587a4af82adccaef8e3b3624b4e7f1c401632d Mon Sep 17 00:00:00 2001 From: Christian Brauner Date: Sat, 26 Sep 2026 15:44:29 +0200 Subject: [PATCH] fs: refuse fspick() on internal superblocks There's a few instances where a internal superblock is reachable by fspick(). Block that. graft_tree() and fsmount() already refuse them. fanotify refuses mount and superblock marks on them for the same reason. Fixes: cf3cba4a429b ("vfs: syscall: Add fspick() to select a superblock for reconfiguration") Cc: stable@vger.kernel.org # v5.2+ Link: https://patch.msgid.link/20260926-work-mount-fixes-2-v1-6-f357abf3d17b@kernel.org Signed-off-by: Christian Brauner (Amutable) --- fs/fsopen.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/fsopen.c b/fs/fsopen.c index ae19e5136598..9d5a7a22b529 100644 --- a/fs/fsopen.c +++ b/fs/fsopen.c @@ -190,6 +190,9 @@ SYSCALL_DEFINE3(fspick, int, dfd, const char __user *, path, unsigned int, flags ret = -EINVAL; if (target.mnt->mnt_root != target.dentry) goto err_path; + /* kernel-internal superblocks are nobody's to reconfigure */ + if (target.dentry->d_sb->s_flags & SB_NOUSER) + goto err_path; fc = fs_context_for_reconfigure(target.dentry, 0, 0); if (IS_ERR(fc)) {