github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-25 15:41:52 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

selftests: fifth test for mounting detached mounts onto detached mounts

Browse Source 
Add a test to verify that detached mounts behave correctly.

Link: https://lore.kernel.org/r/20250221-brauner-open_tree-v1-14-dbcfcb98c676@kernel.org
Signed-off-by: Christian Brauner <brauner@kernel.org>
This commit is contained in:
Christian Brauner 2025-02-21 14:13:13 +01:00
parent 1768f9bd53
commit d346ae7a64
No known key found for this signature in database
GPG Key ID: 91C61BC06578DCA2
1 changed files with 78 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

78
tools/testing/selftests/mount_setattr/mount_setattr_test.c
View File

@ -1939,4 +1939,82 @@ TEST_F(mount_setattr, attach_detached_mount_then_umount_then_close)
EXPECT_EQ(close(fd_tree), 0);
}
TEST_F(mount_setattr, mount_detached1_onto_detached2_then_close_detached1_then_mount_detached2_onto_attached)
{
int fd_tree1 = -EBADF, fd_tree2 = -EBADF;
/*
* |-/mnt/A testing tmpfs
* `-/mnt/A/AA testing tmpfs
* `-/mnt/A/AA/B testing tmpfs
* `-/mnt/A/AA/B/BB testing tmpfs
*/
fd_tree1 = sys_open_tree(-EBADF, "/mnt/A",
AT_NO_AUTOMOUNT | AT_SYMLINK_NOFOLLOW |
AT_RECURSIVE | OPEN_TREE_CLOEXEC |
OPEN_TREE_CLONE);
ASSERT_GE(fd_tree1, 0);
/*
* `-/mnt/B testing ramfs
*/
fd_tree2 = sys_open_tree(-EBADF, "/mnt/B",
AT_NO_AUTOMOUNT | AT_SYMLINK_NOFOLLOW |
AT_EMPTY_PATH | OPEN_TREE_CLOEXEC |
OPEN_TREE_CLONE);
ASSERT_GE(fd_tree2, 0);
/*
* Move the source detached mount tree to the target detached
* mount tree. This will move all the mounts in the source mount
* tree from the source anonymous mount namespace to the target
* anonymous mount namespace.
*
* The source detached mount tree and the target detached mount
* tree now both refer to the same anonymous mount namespace.
*
* |-"" testing ramfs
* `-"" testing tmpfs
* `-""/AA testing tmpfs
* `-""/AA/B testing tmpfs
* `-""/AA/B/BB testing tmpfs
*/
ASSERT_EQ(move_mount(fd_tree1, "", fd_tree2, "", MOVE_MOUNT_F_EMPTY_PATH | MOVE_MOUNT_T_EMPTY_PATH), 0);
/*
* The source detached mount tree @fd_tree1 is now an attached
* mount, i.e., it has a parent. Specifically, it now has the
* root mount of the mount tree of @fd_tree2 as its parent.
*
* That means we are no longer allowed to attach it as we only
* allow attaching the root of an anonymous mount tree, not
* random bits and pieces. Verify that the kernel enforces this.
*/
ASSERT_NE(move_mount(fd_tree1, "", -EBADF, "/tmp/target1", MOVE_MOUNT_F_EMPTY_PATH), 0);
/*
* Closing the source detached mount tree must not unmount and
* free the shared anonymous mount namespace. The kernel will
* quickly yell at us because the anonymous mount namespace
* won't be empty when it's freed.
*/
EXPECT_EQ(close(fd_tree1), 0);
/*
* Attach the mount tree to a non-anonymous mount namespace.
* This can only succeed if closing fd_tree1 had proper
* semantics and didn't cause the anonymous mount namespace to
* be freed. If it did this will trigger a UAF which will be
* visible on any KASAN enabled kernel.
*
* |-/tmp/target1 testing ramfs
* `-/tmp/target1 testing tmpfs
* `-/tmp/target1/AA testing tmpfs
* `-/tmp/target1/AA/B testing tmpfs
* `-/tmp/target1/AA/B/BB testing tmpfs
*/
ASSERT_EQ(move_mount(fd_tree2, "", -EBADF, "/tmp/target1", MOVE_MOUNT_F_EMPTY_PATH), 0);
EXPECT_EQ(close(fd_tree2), 0);
}
TEST_HARNESS_MAIN