From 429f7c4396168006a990e09447dad4b0823d23de Mon Sep 17 00:00:00 2001 From: Lucas Manning Date: Wed, 1 Nov 2023 13:55:18 -0700 Subject: [PATCH] Move rootfs check to inside mountMu. Reported-by: syzbot+811d3f0d101cfe1b1737@syzkaller.appspotmail.com PiperOrigin-RevId: 578631715 --- pkg/sentry/vfs/mount.go | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/pkg/sentry/vfs/mount.go b/pkg/sentry/vfs/mount.go index caedbc579..291a7614c 100644 --- a/pkg/sentry/vfs/mount.go +++ b/pkg/sentry/vfs/mount.go @@ -1040,10 +1040,7 @@ retry: if oldRoot.mount.root != oldRoot.dentry { return newRoot, oldRoot, linuxerr.EINVAL } - // The current root and the new root cannot be on the rootfs mount. - if oldRoot.mount.parent() == nil || newRoot.mount.parent() == nil { - return newRoot, oldRoot, linuxerr.EINVAL - } + // The current root and the new root must be in the context's mount namespace. ns := MountNamespaceFromContext(ctx) defer ns.DecRef(ctx) @@ -1053,6 +1050,12 @@ retry: return newRoot, oldRoot, linuxerr.EINVAL } + // The current root and the new root cannot be on the rootfs mount. + if oldRoot.mount.parent() == nil || newRoot.mount.parent() == nil { + vfs.unlockMounts(ctx) + return newRoot, oldRoot, linuxerr.EINVAL + } + // Either the mount point at new_root, or the parent mount of that mount // point, has propagation type MS_SHARED. if newRootParent := newRoot.mount.parent(); newRoot.mount.isShared || newRootParent.isShared {