fs/fhandle.c: fix a race in call of has_locked_children()

JIRA: https://issues.redhat.com/browse/RHEL-113598
CVE: CVE-2025-38306
Conflicts:
  1) A context diff with the has_locked_children() hunk and a merge
     conflict with clone_private_mount() hunk due to missing
     upstream commit db04662 ("fs: allow detached mounts in
     clone_private_mount()").
  2) A merge conflict with the __do_loopback() hunk due to missing
     upstream commit 9ed72af ("fs: add may_copy_tree()").

commit 1f282cd
Author: Al Viro <viro@zeniv.linux.org.uk>
Date:   Sun, 1 Jun 2025 14:23:52 -0400

    fs/fhandle.c: fix a race in call of has_locked_children()

    may_decode_fh() is calling has_locked_children() while holding no locks.
    That's an oopsable race...

    The rest of the callers are safe since they are holding namespace_sem and
    are guaranteed a positive refcount on the mount in question.

    Rename the current has_locked_children() to __has_locked_children(), make
    it static and switch the fs/namespace.c users to it.

    Make has_locked_children() a wrapper for __has_locked_children(), calling
    the latter under read_seqlock_excl(&mount_lock).

    Reviewed-by: Christian Brauner <brauner@kernel.org>
    Reviewed-by: Jeff Layton <jlayton@kernel.org>
    Fixes: 620c266 ("fhandle: relax open_by_handle_at() permission checks")
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Signed-off-by: Waiman Long <longman@redhat.com>

Author: Waiman-Long

fs/namespace.c

@@ -2232,7 +2232,7 @@ void drop_collected_mounts(struct vfsmount *mnt)
 	namespace_unlock();
 }
 
-bool has_locked_children(struct mount *mnt, struct dentry *dentry)
+static bool __has_locked_children(struct mount *mnt, struct dentry *dentry)
 {
 	struct mount *child;
 
@@ -2246,6 +2246,16 @@ bool has_locked_children(struct mount *mnt, struct dentry *dentry)
 	return false;
 }
 
+bool has_locked_children(struct mount *mnt, struct dentry *dentry)
+{
+	bool res;
+
+	read_seqlock_excl(&mount_lock);
+	res = __has_locked_children(mnt, dentry);
+	read_sequnlock_excl(&mount_lock);
+	return res;
+}
+
 /**
  * clone_private_mount - create a private clone of a path
  * @path: path to clone
@@ -2268,7 +2278,7 @@ struct vfsmount *clone_private_mount(const struct path *path)
 	if (!check_mnt(old_mnt))
 		goto invalid;
 
-	if (has_locked_children(old_mnt, path->dentry))
+	if (__has_locked_children(old_mnt, path->dentry))
 		goto invalid;
 
 	new_mnt = clone_mnt(old_mnt, path->dentry, CL_PRIVATE);
@@ -2747,7 +2757,7 @@ static struct mount *__do_loopback(struct path *old_path, int recurse)
 			return mnt;
 	}
 
-	if (!recurse && has_locked_children(old, old_path->dentry))
+	if (!recurse && __has_locked_children(old, old_path->dentry))
 		return mnt;
 
 	if (recurse)
@@ -3144,7 +3154,7 @@ static int do_set_group(struct path *from_path, struct path *to_path)
 		goto out;
 
 	/* From mount should not have locked children in place of To's root */
-	if (has_locked_children(from, to->mnt.mnt_root))
+	if (__has_locked_children(from, to->mnt.mnt_root))
 		goto out;
 
 	/* Setting sharing groups is only allowed on private mounts */