Unverified Commit 229fd159 authored by Christian Brauner's avatar Christian Brauner
Browse files

fs: don't try and remove empty rbtree node 

When copying a namespace we won't have added the new copy into the
namespace rbtree until after the copy succeeded. Calling free_mnt_ns()
will try to remove the copy from the rbtree which is invalid. Simply
free the namespace skeleton directly.

Link: https://lore.kernel.org/r/20241016-adapter-seilwinde-83c508a7bde1@brauner


Fixes: 1901c924 ("fs: keep an index of current mount namespaces")
Tested-by: default avatarBrad Spengler <spender@grsecurity.net>
Cc: stable@vger.kernel.org # v6.11+
Reported-by: default avatarBrad Spengler <spender@grsecurity.net>
Suggested-by: default avatarBrad Spengler <spender@grsecurity.net>
Signed-off-by: default avatarChristian Brauner <brauner@kernel.org>
parent d6a77668

fs/namespace.c

+3 −1
Original line number Diff line number Diff line
@@ -3944,7 +3944,9 @@ struct mnt_namespace *copy_mnt_ns(unsigned long flags, struct mnt_namespace *ns, 
	new = copy_tree(old, old->mnt.mnt_root, copy_flags);

	if (IS_ERR(new)) {

		namespace_unlock();

		free_mnt_ns(new_ns);

		ns_free_inum(&new_ns->ns);

		dec_mnt_namespaces(new_ns->ucounts);

		mnt_ns_release(new_ns);

		return ERR_CAST(new);

	}

	if (user_ns != ns->user_ns) {