From: Al Viro <viro@zeniv.linux.org.uk> mainline inclusion from mainline-v6.16-rc1 commit 12f147ddd6de7382dad54812e65f3f08d05809fc category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICGF26 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- Ensure that propagation settings can only be changed for mounts located in the caller's mount namespace. This change aligns permission checking with the rest of mount(2). Reviewed-by: Christian Brauner <brauner@kernel.org> Fixes: 07b20889e305 ("beginning of the shared-subtree proper") Reported-by: "Orlando, Noah" <Noah.Orlando@deshaw.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Wang Zhaolong <wangzhaolong@huaweicloud.com> --- fs/namespace.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/namespace.c b/fs/namespace.c index e01e255a5818..c28b26211d22 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -2549,10 +2549,14 @@ static int do_change_type(struct path *path, int ms_flags) type = flags_to_propagation_type(ms_flags); if (!type) return -EINVAL; namespace_lock(); + if (!check_mnt(mnt)) { + err = -EINVAL; + goto out_unlock; + } if (type == MS_SHARED) { err = invent_group_ids(mnt, recurse); if (err) goto out_unlock; } -- 2.34.3