userns and mnt_idmap leak in open_tree_attr(2)

Once want_mount_setattr() has returned a positive, it does require
finish_mount_kattr() to release ->mnt_userns.  Failing do_mount_setattr()
does not change that.

As the result, we can end up leaking userns and possibly mnt_idmap as
well.

Fixes: c4a16820d901 ("fs: add open_tree_attr()")
Reviewed-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

diff --git a/fs/namespace.c b/fs/namespace.c
index eed83254492f3097b7835c89a9941adf3b74b1c2..54c59e091919bcfd224915717af1ac0eb2e25e04 100644 (file)
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -5307,16 +5307,12 @@ SYSCALL_DEFINE5(open_tree_attr, int, dfd, const char __user *, filename,
                        kattr.kflags |= MOUNT_KATTR_RECURSE;
 
                ret = wants_mount_setattr(uattr, usize, &kattr);
-               if (ret < 0)
-                       return ret;
-
-               if (ret) {
+               if (ret > 0) {
                        ret = do_mount_setattr(&file->f_path, &kattr);
-                       if (ret)
-                               return ret;
-
                        finish_mount_kattr(&kattr);
                }
+               if (ret)
+                       return ret;
        }
 
        fd = get_unused_fd_flags(flags & O_CLOEXEC);