Patch "mnt: Add a per mount namespace limit on the number of mounts" has been added to the 4.4-stable tree

This is a note to let you know that I've just added the patch titled

mnt: Add a per mount namespace limit on the number of mounts

to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
mnt-add-a-per-mount-namespace-limit-on-the-number-of-mounts.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: "Eric W. Biederman" <[email protected]>
Date: Wed, 28 Sep 2016 00:27:17 -0500
Subject: mnt: Add a per mount namespace limit on the number of mounts

From: Eric W. Biederman <[email protected]>

commit d29216842a85c7970c536108e093963f02714498 upstream.

CAI Qian <[email protected]> pointed out that the semantics of shared subtrees make it possible to create an exponentially increasing number of mounts in a mount namespace.

    mkdir /tmp/1 /tmp/2
    mount --make-rshared /
    for i in $(seq 1 20) ; do mount --bind /tmp/1 /tmp/2 ; done

Will create create 2^20 or 1048576 mounts, which is a practical problem as some people have managed to hit this by accident.

As such CVE-2016-6213 was assigned.

Ian Kent <[email protected]> described the situation for autofs users as follows:

So I am setting the default number of mounts allowed per mount namespace at 100,000. This is more than enough for any use case I know of, but small enough to quickly stop an exponential increase in mounts. Which should be perfect to catch misconfigurations and malfunctioning programs.

For anyone who needs a higher limit this can be changed by writing to the new /proc/sys/fs/mount-max sysctl.

---
 Documentation/sysctl/fs.txt |    7 ++++++
 fs/mount.h                  |    2 +
 fs/namespace.c              |   50 +++++++++++++++++++++++++++++++++++++++++++-
 fs/pnode.c                  |    2 -
 fs/pnode.h                  |    1 
 include/linux/mount.h       |    2 +
 kernel/sysctl.c             |    9 +++++++
 7 files changed, 71 insertions(+), 2 deletions(-)

@@ -265,6 +265,13 @@ aio-nr can grow to.
 
 ==============================================================
 
+mount-max:
+
+This denotes the maximum number of mounts that may exist
+in a mount namespace.
+
+==============================================================
+
 
 2. /proc/sys/fs/binfmt_misc
 ----------------------------------------------------------

@@ -13,6 +13,8 @@ struct mnt_namespace {
 	u64			seq;	/* Sequence number to prevent loops */
 	wait_queue_head_t poll;
 	u64 event;
+	unsigned int		mounts; /* # of mounts in the namespace */
+	unsigned int		pending_mounts;
 };
 
 struct mnt_pcp {

@@ -259,7 +259,7 @@ static int propagate_one(struct mount *m
 		read_sequnlock_excl(&mount_lock);
 	}
 	hlist_add_head(&child->mnt_hash, list);
-	return 0;
+	return count_mounts(m->mnt_ns, child);
 }
 
 /*

@@ -54,4 +54,5 @@ void mnt_change_mountpoint(struct mount
 struct mount *copy_tree(struct mount *, struct dentry *, int);
 bool is_path_reachable(struct mount *, struct dentry *,
 			 const struct path *root);
+int count_mounts(struct mnt_namespace *ns, struct mount *mnt);
 #endif /* _LINUX_PNODE_H */

@@ -95,4 +95,6 @@ extern void mark_mounts_for_expiry(struc
 
 extern dev_t name_to_dev_t(const char *name);
 
+extern unsigned int sysctl_mount_max;
+
 #endif /* _LINUX_MOUNT_H */

@@ -65,6 +65,7 @@
 #include <linux/sched/sysctl.h>
 #include <linux/kexec.h>
 #include <linux/bpf.h>
+#include <linux/mount.h>
 
 #include <asm/uaccess.h>
 #include <asm/processor.h>

@@ -1749,6 +1750,14 @@ static struct ctl_table fs_table[] = {
 		.mode		= 0644,
 		.proc_handler	= proc_doulongvec_minmax,
 	},
+	{
+		.procname	= "mount-max",
+		.data		= &sysctl_mount_max,
+		.maxlen		= sizeof(unsigned int),
+		.mode		= 0644,
+		.proc_handler	= proc_dointvec_minmax,
+		.extra1		= &one,
+	},
 	{ }
 };
 

Patches currently in stable-queue which might be from [email protected] are

queue-4.4/mnt-add-a-per-mount-namespace-limit-on-the-number-of-mounts.patch