From: Christian Brauner <brauner@kernel.org>
Date: Mon, 29 Sep 2025 09:41:16 +0000 (+0200)
Subject: mount: handle NULL values in mnt_ns_release()
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6c7ca6a02f8f9549a438a08a23c6327580ecf3d6;p=thirdparty%2Fkernel%2Fstable.git

mount: handle NULL values in mnt_ns_release()

When calling in listmount() mnt_ns_release() may be passed a NULL
pointer. Handle that case gracefully.

Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
---

diff --git a/fs/namespace.c b/fs/namespace.c
index 38609066cf33..1ee17a00c311 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -180,7 +180,7 @@ static void mnt_ns_tree_add(struct mnt_namespace *ns)
 static void mnt_ns_release(struct mnt_namespace *ns)
 {
 	/* keep alive for {list,stat}mount() */
-	if (refcount_dec_and_test(&ns->passive)) {
+	if (ns && refcount_dec_and_test(&ns->passive)) {
 		fsnotify_mntns_delete(ns);
 		put_user_ns(ns->user_ns);
 		kfree(ns);