[PATCH][RFC] userns and mnt_idmap leak in open_tree_attr(2)

[PATCH][RFC] userns and mnt_idmap leak in open_tree_attr(2)

[Al Viro]

[if nobody objects, I'm going to throw that into #fixes and send to Linus
in a couple of days]

Once want_mount_setattr() has returned a positive, it does require
finish_mount_kattr() to release ->mnt_userns.  Failing do_mount_setattr()
does not change that.

As the result, we can end up leaking userns and possibly mnt_idmap as
well.

Fixes: c4a16820d901 ("fs: add open_tree_attr()")
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
diff --git a/fs/namespace.c b/fs/namespace.c
index eed83254492f..54c59e091919 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -5307,16 +5307,12 @@ SYSCALL_DEFINE5(open_tree_attr, int, dfd, const char __user *, filename,
 			kattr.kflags |= MOUNT_KATTR_RECURSE;
 
 		ret = wants_mount_setattr(uattr, usize, &kattr);
-		if (ret < 0)
-			return ret;
-
-		if (ret) {
+		if (ret > 0) {
 			ret = do_mount_setattr(&file->f_path, &kattr);
-			if (ret)
-				return ret;
-
 			finish_mount_kattr(&kattr);
 		}
+		if (ret)
+			return ret;
 	}
 
 	fd = get_unused_fd_flags(flags & O_CLOEXEC);

Re: [PATCH][RFC] userns and mnt_idmap leak in open_tree_attr(2)

[Christian Brauner]

On Tue, Jun 24, 2025 at 07:57:46AM +0100, Al Viro wrote:
> [if nobody objects, I'm going to throw that into #fixes and send to Linus
> in a couple of days]
> 
> Once want_mount_setattr() has returned a positive, it does require
> finish_mount_kattr() to release ->mnt_userns.  Failing do_mount_setattr()
> does not change that.
> 
> As the result, we can end up leaking userns and possibly mnt_idmap as
> well.
> 
> Fixes: c4a16820d901 ("fs: add open_tree_attr()")
> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
> ---

Sure, thanks!
Reviewed-by: Christian Brauner <brauner@kernel.org>