On Tue, Jul 21, 2020 at 09:49:17AM -0700, Linus Torvalds wrote:

On Tue, Jul 21, 2020 at 9:28 AM Christoph Hellwig [off-list ref] wrote:

quoted

+
+       /* traverse into overmounted root and then chroot to it */
+       if (!kern_path("/..", LOOKUP_FOLLOW | LOOKUP_DIRECTORY, &path) &&
+           !inode_permission(path.dentry->d_inode, MAY_EXEC | MAY_CHDIR) &&
+           ns_capable(current_user_ns(), CAP_SYS_CHROOT) &&
+           !security_path_chroot(&path)) {
+               set_fs_pwd(current->fs, &path);
+               set_fs_root(current->fs, &path);
+       }
+       path_put(&path);

This looks wrong.

It is wrong.  kern_path() leaves *path unmodified in case of error, and
that struct path is uninitialized here.