On Wed, Jun 04, 2025 at 12:16:32AM +0100, Al Viro wrote:
> may_decode_fh() is calling has_locked_children() while holding no locks.
> That's an oopsable race...
>
> The rest of the callers are safe since they are holding namespace_sem and
> are guaranteed a positive refcount on the mount in question.
>
> Rename the current has_locked_children() to __has_locked_children(), make
> it static and switch the fs/namespace.c users to it.
>
> Make has_locked_children() a wrapper for __has_locked_children(), calling
> the latter under read_seqlock_excl(&mount_lock).
>
> Fixes: 620c266f3949 ("fhandle: relax open_by_handle_at() permission checks")
> Signed-off-by: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
> ---
Reviewed-by: Christian Brauner <brauner@xxxxxxxxxx>
