Merge tag 'vfs-7.2-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull vfs fixes from Christian Brauner:

 - Don't warn when a mount is completed from another user namespace.

   fsopen() records the caller's user namespace in fc->user_ns and
   hands back an ordinary file descriptor. The task that calls
   fsconfig(FSCONFIG_CMD_CREATE) doesn't have to be the one that
   created the context, and mount_capable() lets it through as long
   as the caller has CAP_SYS_ADMIN over fc->user_ns, which anyone in
   an ancestor namespace does. So fc->user_ns != current_user_ns()
   is something an unprivileged user can arrange.

   Both overlayfs and binfmt_misc WARN_ON() that. Overlayfs already
   has the same check as a plain error return in ovl_parse_param().

   Drop the WARN_ON() and just refuse. Add selftests for both cases.

 - Reject pid allocations through dead ancestor pid namespaces.

   Require PIDNS_ADDING in every namespace that will receive the pid
   before publishing any of them. That preserves the invariant that
   free_pid() never decrements pid_allocated in a namespace whose
   child_reaper is no longer live. The existing ENOMEM behavior is
   unchanged.

* tag 'vfs-7.2-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  pid: reject allocations through dead ancestor pid namespaces
  selftests/filesystems: test completing a context from another user namespace
  binfmt_misc: don't warn when the mount is completed from another user namespace
  ovl: don't warn when the mount is completed from another user namespace

1 files changed, 4 insertions, 2 deletions

diff --git a/kernel/pid.c b/kernel/pid.c
index f55189a3d07d..d01d0dd7114b 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -324,8 +324,10 @@ struct pid *alloc_pid(struct pid_namespace *ns, pid_t *arg_set_tid,
 	 * error path may try to wakeup the possibly freed ns->child_reaper.
 	 */
 	retval = -ENOMEM;
-	if (unlikely(!(ns->pid_allocated & PIDNS_ADDING)))
-		goto out_free;
+	for (upid = pid->numbers + ns->level; upid >= pid->numbers; --upid)
+		if (unlikely(!(upid->ns->pid_allocated & PIDNS_ADDING)))
+			goto out_free;
+
 	for (upid = pid->numbers + ns->level; upid >= pid->numbers; --upid) {
 		/* Make the PID visible to find_pid_ns. */
 		idr_replace(&upid->ns->idr, pid, upid->nr);