[Devel] [PATCH RH7 03/22] fs: fix a posible leak of allocated superblock

[Pavel Tikhomirov]

Imagine posible code path in sget_userns: we iterate in
type->fs_supers and do not find suitable sb, we drop sb_lock to
allocate s and go to retry. After we dropped sb_lock some other
task from different userns takes sb_lock, it is already in retry
stage and has s allocated, so it puts its s in type->fs_supers
list. So we will find these sb in list and check it has different
userns, and finally we return without freeing s.

Signed-off-by: Pavel Tikhomirov <ptikhomirov at virtuozzo.com>
---
 fs/super.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/super.c b/fs/super.c
index b4ee02b..24771b5 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -458,6 +458,10 @@ struct super_block *sget_userns(struct file_system_type *type,
 				continue;
 			if (user_ns != old->s_user_ns) {
 				spin_unlock(&sb_lock);
+				if (s) {
+					up_write(&s->s_umount);
+					destroy_super(s);
+				}
 				return ERR_PTR(-EBUSY);
 			}
 			if (!grab_super(old))
-- 
1.9.3