]> git.proxmox.com Git - mirror_ubuntu-eoan-kernel.git/commit
mnt: Prevent pivot_root from creating a loop in the mount tree
authorEric W. Biederman <ebiederm@xmission.com>
Wed, 8 Oct 2014 17:42:27 +0000 (10:42 -0700)
committerAndy Lutomirski <luto@amacapital.net>
Tue, 14 Oct 2014 21:27:19 +0000 (14:27 -0700)
commit0d0826019e529f21c84687521d03f60cd241ca7d
treef7bbcc1e7969449c56601afa2a21e51ba8e3fb05
parentc798360cd1438090d51eeaa8e67985da11362eba
mnt: Prevent pivot_root from creating a loop in the mount tree

Andy Lutomirski recently demonstrated that when chroot is used to set
the root path below the path for the new ``root'' passed to pivot_root
the pivot_root system call succeeds and leaks mounts.

In examining the code I see that starting with a new root that is
below the current root in the mount tree will result in a loop in the
mount tree after the mounts are detached and then reattached to one
another.  Resulting in all kinds of ugliness including a leak of that
mounts involved in the leak of the mount loop.

Prevent this problem by ensuring that the new mount is reachable from
the current root of the mount tree.

[Added stable cc.  Fixes CVE-2014-7970.  --Andy]

Cc: stable@vger.kernel.org
Reported-by: Andy Lutomirski <luto@amacapital.net>
Reviewed-by: Andy Lutomirski <luto@amacapital.net>
Link: http://lkml.kernel.org/r/87bnpmihks.fsf@x220.int.ebiederm.org
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
fs/namespace.c