diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2025-06-24 17:25:04 +0300 |
|---|---|---|
| committer | Al Viro <viro@zeniv.linux.org.uk> | 2025-06-24 17:25:04 +0300 |
| commit | 0748e553df0225754c316a92af3a77fdc057b358 (patch) | |
| tree | 5344ea758d9a9fa9e3464d205e8567fba08c2e11 | |
| parent | ce7df19686530920f2f6b636e71ce5eb1d9303ef (diff) | |
| download | linux-0748e553df0225754c316a92af3a77fdc057b358.tar.xz | |
userns and mnt_idmap leak in open_tree_attr(2)
Once want_mount_setattr() has returned a positive, it does require
finish_mount_kattr() to release ->mnt_userns. Failing do_mount_setattr()
does not change that.
As the result, we can end up leaking userns and possibly mnt_idmap as
well.
Fixes: c4a16820d901 ("fs: add open_tree_attr()")
Reviewed-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
| -rw-r--r-- | fs/namespace.c | 10 |
1 files changed, 3 insertions, 7 deletions
diff --git a/fs/namespace.c b/fs/namespace.c index eed83254492f..54c59e091919 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -5307,16 +5307,12 @@ SYSCALL_DEFINE5(open_tree_attr, int, dfd, const char __user *, filename, kattr.kflags |= MOUNT_KATTR_RECURSE; ret = wants_mount_setattr(uattr, usize, &kattr); - if (ret < 0) - return ret; - - if (ret) { + if (ret > 0) { ret = do_mount_setattr(&file->f_path, &kattr); - if (ret) - return ret; - finish_mount_kattr(&kattr); } + if (ret) + return ret; } fd = get_unused_fd_flags(flags & O_CLOEXEC); |