fs/namespace: fix reference leak in grab_requested_mnt_ns

[ Upstream commit 7b6dcd9bfd869eee7693e45b1817dac8c56e5f86 ]

lookup_mnt_ns() already takes a reference on mnt_ns.
grab_requested_mnt_ns() doesn't need to take an extra reference.

Fixes: 78f0e33cd6c93 ("fs/namespace: correctly handle errors returned by grab_requested_mnt_ns")
Signed-off-by: Andrei Vagin <avagin@google.com>
Link: https://patch.msgid.link/20251122071953.3053755-1-avagin@google.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/fs/namespace.c b/fs/namespace.c
index fd988bc759bd3e19067132034a17a8770f06d0b3..e059c2c9867f00fdbc9047983e7ace68a0c6141c 100644 (file)
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -5901,6 +5901,8 @@ static struct mnt_namespace *grab_requested_mnt_ns(const struct mnt_id_req *kreq
 
        if (kreq->mnt_ns_id) {
                mnt_ns = lookup_mnt_ns(kreq->mnt_ns_id);
+               if (!mnt_ns)
+                       return ERR_PTR(-ENOENT);
        } else if (kreq->mnt_ns_fd) {
                struct ns_common *ns;
 
@@ -5916,13 +5918,12 @@ static struct mnt_namespace *grab_requested_mnt_ns(const struct mnt_id_req *kreq
                        return ERR_PTR(-EINVAL);
 
                mnt_ns = to_mnt_ns(ns);
+               refcount_inc(&mnt_ns->passive);
        } else {
                mnt_ns = current->nsproxy->mnt_ns;
+               refcount_inc(&mnt_ns->passive);
        }
-       if (!mnt_ns)
-               return ERR_PTR(-ENOENT);
 
-       refcount_inc(&mnt_ns->passive);
        return mnt_ns;
 }