stuartl/linux-mainline
1
0
Fork 0
mirror of https://kernel.googlesource.com/pub/scm/linux/kernel/git/torvalds/linux synced 2025-10-15 09:17:43 +10:00
Code Issues Releases Wiki Activity

userns and mnt_idmap leak in open_tree_attr(2)

Browse Source 
Once want_mount_setattr() has returned a positive, it does require
finish_mount_kattr() to release ->mnt_userns.  Failing do_mount_setattr()
does not change that.

As the result, we can end up leaking userns and possibly mnt_idmap as
well.

Fixes: c4a16820d9 ("fs: add open_tree_attr()")
Reviewed-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
This commit is contained in:
Al Viro 2025-06-24 10:25:04 -04:00
parent ce7df19686
commit 0748e553df
1 changed files with 3 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
fs/namespace.c
View File

@ -5307,16 +5307,12 @@ SYSCALL_DEFINE5(open_tree_attr, int, dfd, const char __user *, filename,
kattr.kflags |= MOUNT_KATTR_RECURSE;
ret = wants_mount_setattr(uattr, usize, &kattr);
if (ret < 0)
return ret;
if (ret) {
if (ret > 0) {
ret = do_mount_setattr(&file->f_path, &kattr);
if (ret)
return ret;
finish_mount_kattr(&kattr);
}
if (ret)
return ret;
}
fd = get_unused_fd_flags(flags & O_CLOEXEC);