fs/namespace: fix reference leak in grab_requested_mnt_ns

lookup_mnt_ns() already takes a reference on mnt_ns.
grab_requested_mnt_ns() doesn't need to take an extra reference.

Fixes: 78f0e33cd6c93 ("fs/namespace: correctly handle errors returned by grab_requested_mnt_ns")
Signed-off-by: Andrei Vagin <avagin@google.com>
Link: https://patch.msgid.link/20251122071953.3053755-1-avagin@google.com
Signed-off-by: Christian Brauner <brauner@kernel.org>

diff --git a/fs/namespace.c b/fs/namespace.c
index 2bad25709b2c034283c8f150283e05824d775f8b..4272349650b14b83f2bff9ab47016def0a2f4f78 100644 (file)
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -5746,6 +5746,8 @@ static struct mnt_namespace *grab_requested_mnt_ns(const struct mnt_id_req *kreq
 
        if (kreq->mnt_ns_id) {
                mnt_ns = lookup_mnt_ns(kreq->mnt_ns_id);
+               if (!mnt_ns)
+                       return ERR_PTR(-ENOENT);
        } else if (kreq->mnt_ns_fd) {
                struct ns_common *ns;
 
@@ -5761,13 +5763,12 @@ static struct mnt_namespace *grab_requested_mnt_ns(const struct mnt_id_req *kreq
                        return ERR_PTR(-EINVAL);
 
                mnt_ns = to_mnt_ns(ns);
+               refcount_inc(&mnt_ns->passive);
        } else {
                mnt_ns = current->nsproxy->mnt_ns;
+               refcount_inc(&mnt_ns->passive);
        }
-       if (!mnt_ns)
-               return ERR_PTR(-ENOENT);
 
-       refcount_inc(&mnt_ns->passive);
        return mnt_ns;
 }