fs: Avoid userspace mounting anon_inodefs filesystem

jankara · torvalds · commit d6f2589ad561 · 2014-03-25T17:42:16.000-07:00
anon_inodefs filesystem is a kernel internal filesystem userspace
shouldn't mess with. Remove registration of it so userspace cannot
even try to mount it (which would fail anyway because the filesystem is
MS_NOUSER).

This fixes an oops triggered by trinity when it tried mounting
anon_inodefs which overwrote anon_inode_inode pointer while other CPU
has been in anon_inode_getfile() between ihold() and d_instantiate().
Thus effectively creating dentry pointing to an inode without holding a
reference to it.

Reported-by: Sasha Levin &lt;sasha.levin@oracle.com&gt;
Signed-off-by: Jan Kara &lt;jack@suse.cz&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
diff --git a/fs/anon_inodes.c b/fs/anon_inodes.c
@@ -177,9 +177,6 @@ static int __init anon_inode_init(void)
 {
 	int error;
 
-	error = register_filesystem(&anon_inode_fs_type);
-	if (error)
-		goto err_exit;
 	anon_inode_mnt = kern_mount(&anon_inode_fs_type);
 	if (IS_ERR(anon_inode_mnt)) {
 		error = PTR_ERR(anon_inode_mnt);

Original file line number	Diff line number	Diff line change
`@@ -177,9 +177,6 @@ static int __init anon_inode_init(void)`
`177`	`177`	`{`
`178`	`178`	`int error;`
`179`	`179`
`180`		`- error = register_filesystem(&anon_inode_fs_type);`
`181`		`- if (error)`
`182`		`- goto err_exit;`
`183`	`180`	`anon_inode_mnt = kern_mount(&anon_inode_fs_type);`
`184`	`181`	`if (IS_ERR(anon_inode_mnt)) {`
`185`	`182`	`error = PTR_ERR(anon_inode_mnt);`