kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00
Code Issues Releases Packages Activity

Merge patch series "mount: a few additional bugfixes"

Browse source 
Christian Brauner <brauner@kernel.org> says:

Here's a set of additional mount fixes that fell out of my recent look
at the mount code:

- Fix a UAF in mnt_change_mountpoint().
- Fix a UAF in statmount().
- FIX a UAF and various associated bugs in clone_mnt()
- Prevent copying an unmounted mount tree.
- Avoid pointless work in mount_setattr().
- Refuse fspick() on kernel internal superblocks.
- Simplify dissolve_on_fput() and unshare().

* patches from https://patch.msgid.link/20260926-work-mount-fixes-2-v1-0-f357abf3d17b@kernel.org:
  selftests/filesystems: check that a dead mount's overmount isn't followed
  selftests/filesystems: check that an unmounted mount tree isn't walked
  namespace: drop the file's reference first in dissolve_on_fput()
  fs: put the old fs_struct before the old namespaces in unshare()
  fs: refuse fspick() on internal superblocks
  namespace: check the target before walking it in do_mount_setattr()
  namespace: don't copy an unmounted mount tree
  namespace: don't inherit MNT_UMOUNT in clone_mnt()
  statmount: read the parent of an unmounted mount under mount_lock
  namespace: reset the old parent's ->overmount in mnt_change_mountpoint()

Link: https://patch.msgid.link/20260926-work-mount-fixes-2-v1-0-f357abf3d17b@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
This commit is contained in:
Christian Brauner 2026-09-26 15:47:54 +02:00
commit b4698e50d4
No known key found for this signature in database
GPG key ID: 91C61BC06578DCA2
10 changed files with 719 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files