tree 805babc9e4cae48f2a04bb6a52985109b27dd4bc
parent 3d275f1675eb7ce3adcf2bbdc584709dbf71b4b5
author Piotr Krysiuk <piotras@gmail.com> 1587983652 +0100
committer Greg Kroah-Hartman <gregkh@linuxfoundation.org> 1588432990 +0200

fs/namespace.c: fix mountpoint reference counter race

A race condition between threads updating mountpoint reference counter
affects longterm releases 4.4.220, 4.9.220, 4.14.177 and 4.19.118.

The mountpoint reference counter corruption may occur when:
* one thread increments m_count member of struct mountpoint
  [under namespace_sem, but not holding mount_lock]
    pivot_root()
* another thread simultaneously decrements the same m_count
  [under mount_lock, but not holding namespace_sem]
    put_mountpoint()
      unhash_mnt()
        umount_mnt()
          mntput_no_expire()

To fix this race condition, grab mount_lock before updating m_count in
pivot_root().

Reference: CVE-2020-12114
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Piotr Krysiuk <piotras@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>