From: Al Viro <viro@zeniv.linux.org.uk>
Date: Tue, 26 Aug 2025 21:04:44 +0000 (-0400)
Subject: copy_mnt_ns(): use the regular mechanism for freeing empty mnt_ns on failure
X-Git-Tag: v6.18-rc1~128^2~7
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=7bb4c851dcb7a4ec0b4ba7fcf3f451da0894969d;p=thirdparty%2Flinux.git

copy_mnt_ns(): use the regular mechanism for freeing empty mnt_ns on failure

Now that free_mnt_ns() works prior to mnt_ns_tree_add(), there's no need for
an open-coded analogue free_mnt_ns() there - yes, we do avoid one call_rcu()
use per failing call of clone() or unshare(), if they fail due to OOM in that
particular spot, but it's not really worth bothering.

Reviewed-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---

diff --git a/fs/namespace.c b/fs/namespace.c
index 5968c44cc38aa..b4374d6d4bae2 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -4184,10 +4184,8 @@ struct mnt_namespace *copy_mnt_ns(unsigned long flags, struct mnt_namespace *ns,
 		copy_flags |= CL_SLAVE;
 	new = copy_tree(old, old->mnt.mnt_root, copy_flags);
 	if (IS_ERR(new)) {
+		emptied_ns = new_ns;
 		namespace_unlock();
-		ns_free_inum(&new_ns->ns);
-		dec_mnt_namespaces(new_ns->ucounts);
-		mnt_ns_release(new_ns);
 		return ERR_CAST(new);
 	}
 	if (user_ns != ns->user_ns) {