diff options
| author | Christian Brauner <brauner@kernel.org> | 2024-10-16 19:49:48 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-11-01 02:02:41 +0100 |
| commit | a8b155a2c30dc9a5ba837aa5fcba9a47cc031a9b (patch) | |
| tree | d6f67c95e75b5df12b07fbf9f25e03c3219d7e72 | |
| parent | c6f58ff2d4c552927fe9a187774e668ebba6c7aa (diff) | |
fs: don't try and remove empty rbtree node
commit 229fd15908fe1f99b1de4cde3326e62d1e892611 upstream.
When copying a namespace we won't have added the new copy into the
namespace rbtree until after the copy succeeded. Calling free_mnt_ns()
will try to remove the copy from the rbtree which is invalid. Simply
free the namespace skeleton directly.
Link: https://lore.kernel.org/r/20241016-adapter-seilwinde-83c508a7bde1@brauner
Fixes: 1901c92497bd ("fs: keep an index of current mount namespaces")
Tested-by: Brad Spengler <spender@grsecurity.net>
Cc: stable@vger.kernel.org # v6.11+
Reported-by: Brad Spengler <spender@grsecurity.net>
Suggested-by: Brad Spengler <spender@grsecurity.net>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | fs/namespace.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/fs/namespace.c b/fs/namespace.c index 155c6abda71da..666070457cf74 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -3917,7 +3917,9 @@ struct mnt_namespace *copy_mnt_ns(unsigned long flags, struct mnt_namespace *ns, new = copy_tree(old, old->mnt.mnt_root, copy_flags); if (IS_ERR(new)) { namespace_unlock(); - free_mnt_ns(new_ns); + ns_free_inum(&new_ns->ns); + dec_mnt_namespaces(new_ns->ucounts); + mnt_ns_release(new_ns); return ERR_CAST(new); } if (user_ns != ns->user_ns) { |