]> git.ipfire.org Git - thirdparty/kernel/stable.git/commitdiff
mnt_ns_tree_remove(): DTRT if mnt_ns had never been added to mnt_ns_list
authorAl Viro <viro@zeniv.linux.org.uk>
Tue, 26 Aug 2025 20:35:55 +0000 (16:35 -0400)
committerAl Viro <viro@zeniv.linux.org.uk>
Tue, 16 Sep 2025 04:33:37 +0000 (00:33 -0400)
Actual removal is done under the lock, but for checking if need to bother
the lockless RB_EMPTY_NODE() is safe - either that namespace had never
been added to mnt_ns_tree, in which case the the node will stay empty, or
whoever had allocated it has called mnt_ns_tree_add() and it has already
run to completion.  After that point RB_EMPTY_NODE() will become false and
will remain false, no matter what we do with other nodes in the tree.

Reviewed-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
fs/namespace.c

index ae6d1312b1849cdfe11ee1bb1d98e96d6db8f2db..39afeb521a80c077eef77d0424886663fd73198c 100644 (file)
@@ -187,7 +187,7 @@ static void mnt_ns_release_rcu(struct rcu_head *rcu)
 static void mnt_ns_tree_remove(struct mnt_namespace *ns)
 {
        /* remove from global mount namespace list */
-       if (!is_anon_ns(ns)) {
+       if (!RB_EMPTY_NODE(&ns->mnt_ns_tree_node)) {
                mnt_ns_tree_write_lock();
                rb_erase(&ns->mnt_ns_tree_node, &mnt_ns_tree);
                list_bidir_del_rcu(&ns->mnt_ns_list);