)]}'
{
  "commit": "93717b608dd30f9d41b15a72e809238807c68026",
  "tree": "3a449a6a2ee36b2932f0174f8854559a20ebd3d0",
  "parents": [
    "4094a44201db7a3fd95d216e01ec85d748968110"
  ],
  "author": {
    "name": "Tadeusz Struk",
    "email": "tadeusz.struk@linaro.org",
    "time": "Wed Jan 12 13:52:50 2022 -0800"
  },
  "committer": {
    "name": "Lee Jones",
    "email": "joneslee@google.com",
    "time": "Wed Jan 26 09:05:16 2022 +0000"
  },
  "message": "ANDROID: incremental-fs: fix mount_fs issue\n\nSyzbot recently found a number of issues related to incremental-fs\n(see bug numbers below). All have to do with the fact that incr-fs\nallows mounts of the same source and target multiple times.\nThe correct behavior for a file system is to allow only one such\nmount, and then every subsequent attempt should fail with a -EBUSY\nerror code. In case of the issues listed below the common pattern\nis that the reproducer calls:\n\nmount(\"./file0\", \"./file0\", \"incremental-fs\", 0, NULL)\n\nmany times and then invokes a file operation like chmod, setxattr,\nor open on the ./file0. This causes a recursive call for all the\nmounted instances, which eventually causes a stack overflow and\na kernel crash:\n\nBUG: stack guard page was hit at ffffc90000c0fff8\nkernel stack overflow (double-fault): 0000 [#1] PREEMPT SMP KASAN\n\nThe reason why many mounts with the same source and target are\npossible is because the incfs_mount_fs() as it is allocates a new\nsuper_block for every call, regardless of whether a given mount already\nexists or not. This happens every time the sget() function is called\nwith a test param equal to NULL.\nThe correct behavior for an FS mount implementation is to call\nappropriate mount vfs call for it\u0027s type, i.e. mount_bdev() for\na block device backed FS, mount_single() for a pseudo file system,\nlike sysfs that is mounted in a single, well know location, or\nmount_nodev() for other special purpose FS like overlayfs.\nIn case of incremental-fs the open coded mount logic doesn\u0027t check\nfor abusive mount attempts such as overlays.\nTo fix this issue the logic needs to be changed to pass a proper\ntest function to sget() call, which then checks if a super_block\nfor a mount instance has already been allocated and also allows\nthe VFS to properly verify invalid mount attempts.\n\nBug: 211066171\nBug: 213140206\nBug: 213215835\nBug: 211914587\nBug: 211213635\nBug: 213137376\nBug: 211161296\n\nSigned-off-by: Tadeusz Struk \u003ctadeusz.struk@linaro.org\u003e\nChange-Id: I66cfc3f1b5aaffb32b0845b2dad3ff26fe952e27\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "fbab68a280d5c537659d056a75be00571a8ad927",
      "old_mode": 33188,
      "old_path": "fs/incfs/data_mgmt.c",
      "new_id": "a383c5b5ad7f7a121bc8e88892e83cb904bda1f2",
      "new_mode": 33188,
      "new_path": "fs/incfs/data_mgmt.c"
    },
    {
      "type": "modify",
      "old_id": "ea7866fbfd6e1a2beef7e8a9bff53653ad4d3ab2",
      "old_mode": 33188,
      "old_path": "fs/incfs/vfs.c",
      "new_id": "35ac6e3daf8ecbc7dcd67c16b32b2065d766e618",
      "new_mode": 33188,
      "new_path": "fs/incfs/vfs.c"
    },
    {
      "type": "modify",
      "old_id": "79fdf243733d4c87acef1abb44a5125c4f5ba173",
      "old_mode": 33188,
      "old_path": "fs/incfs/vfs.h",
      "new_id": "8876e63a8b0f9a7f3b826be2beec81f60c21d940",
      "new_mode": 33188,
      "new_path": "fs/incfs/vfs.h"
    }
  ]
}