diff options
| author | Andrei Vagin <avagin@google.com> | 2025-11-22 07:19:53 +0000 |
|---|---|---|
| committer | Christian Brauner <brauner@kernel.org> | 2025-11-25 09:34:56 +0100 |
| commit | 7b6dcd9bfd869eee7693e45b1817dac8c56e5f86 (patch) | |
| tree | da8c72e3b3cbb3b2335abfac9145be0bac44a525 /fs/namespace.c | |
| parent | ac3fd01e4c1efce8f2c054cdeb2ddd2fc0fb150d (diff) | |
fs/namespace: fix reference leak in grab_requested_mnt_ns
lookup_mnt_ns() already takes a reference on mnt_ns.
grab_requested_mnt_ns() doesn't need to take an extra reference.
Fixes: 78f0e33cd6c93 ("fs/namespace: correctly handle errors returned by grab_requested_mnt_ns")
Signed-off-by: Andrei Vagin <avagin@google.com>
Link: https://patch.msgid.link/20251122071953.3053755-1-avagin@google.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
Diffstat (limited to 'fs/namespace.c')
| -rw-r--r-- | fs/namespace.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/fs/namespace.c b/fs/namespace.c index 2bad25709b2c..4272349650b1 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -5746,6 +5746,8 @@ static struct mnt_namespace *grab_requested_mnt_ns(const struct mnt_id_req *kreq if (kreq->mnt_ns_id) { mnt_ns = lookup_mnt_ns(kreq->mnt_ns_id); + if (!mnt_ns) + return ERR_PTR(-ENOENT); } else if (kreq->mnt_ns_fd) { struct ns_common *ns; @@ -5761,13 +5763,12 @@ static struct mnt_namespace *grab_requested_mnt_ns(const struct mnt_id_req *kreq return ERR_PTR(-EINVAL); mnt_ns = to_mnt_ns(ns); + refcount_inc(&mnt_ns->passive); } else { mnt_ns = current->nsproxy->mnt_ns; + refcount_inc(&mnt_ns->passive); } - if (!mnt_ns) - return ERR_PTR(-ENOENT); - refcount_inc(&mnt_ns->passive); return mnt_ns; } |