Unverified Commit 7b6dcd9b authored by Andrei Vagin's avatar Andrei Vagin Committed by Christian Brauner
Browse files

fs/namespace: fix reference leak in grab_requested_mnt_ns 



lookup_mnt_ns() already takes a reference on mnt_ns.
grab_requested_mnt_ns() doesn't need to take an extra reference.

Fixes: 78f0e33c ("fs/namespace: correctly handle errors returned by grab_requested_mnt_ns")
Signed-off-by: default avatarAndrei Vagin <avagin@google.com>
Link: https://patch.msgid.link/20251122071953.3053755-1-avagin@google.com


Signed-off-by: default avatarChristian Brauner <brauner@kernel.org>
parent ac3fd01e

fs/namespace.c

+4 −3
Original line number Diff line number Diff line
@@ -5746,6 +5746,8 @@ static struct mnt_namespace *grab_requested_mnt_ns(const struct mnt_id_req *kreq 


	if (kreq->mnt_ns_id) {

		mnt_ns = lookup_mnt_ns(kreq->mnt_ns_id);

		if (!mnt_ns)

			return ERR_PTR(-ENOENT);

	} else if (kreq->mnt_ns_fd) {

		struct ns_common *ns;
@@ -5761,13 +5763,12 @@ static struct mnt_namespace *grab_requested_mnt_ns(const struct mnt_id_req *kreq 
			return ERR_PTR(-EINVAL);



		mnt_ns = to_mnt_ns(ns);

		refcount_inc(&mnt_ns->passive);

	} else {

		mnt_ns = current->nsproxy->mnt_ns;

		refcount_inc(&mnt_ns->passive);

	}

	if (!mnt_ns)

		return ERR_PTR(-ENOENT);



	refcount_inc(&mnt_ns->passive);

	return mnt_ns;

}