[bug report] listmount: don't call path_put() under namespace semaphore

[bug report] listmount: don't call path_put() under namespace semaphore

[Dan Carpenter]

Hello Christian Brauner,

Commit 59bfb6681680 ("listmount: don't call path_put() under
namespace semaphore") from Sep 19, 2025 (linux-next), leads to the
following Smatch static checker warning:

	fs/namespace.c:5939 __do_sys_listmount()
	warn: pointer dereferenced without being set 'kls.ns'

fs/namespace.c
  5903  static void __free_klistmount_free(const struct klistmount *kls)
  5904  {
  5905          path_put(&kls->root);
  5906          kvfree(kls->kmnt_ids);
  5907          mnt_ns_release(kls->ns);
  5908  }

[ snip ]

    5936 SYSCALL_DEFINE4(listmount, const struct mnt_id_req __user *, req,
    5937                 u64 __user *, mnt_ids, size_t, nr_mnt_ids, unsigned int, flags)
    5938 {
--> 5939         struct klistmount kls __free(klistmount_free) = {};
    5940         const size_t maxcount = 1000000;
    5941         struct mnt_id_req kreq;
    5942         ssize_t ret;
    5943 
    5944         if (flags & ~LISTMOUNT_REVERSE)
    5945                 return -EINVAL;

The __free_klistmount_free() function will dereference kls->ns when it
calls mnt_ns_release() but it's NULL on this path.

    5946 
    5947         /*
    5948          * If the mount namespace really has more than 1 million mounts the
    5949          * caller must iterate over the mount namespace (and reconsider their

regards,
dan carpenter

Re: [bug report] listmount: don't call path_put() under namespace semaphore

[Christian Brauner]

On Thu, Sep 25, 2025 at 03:57:43PM +0300, Dan Carpenter wrote:
> Hello Christian Brauner,
> 
> Commit 59bfb6681680 ("listmount: don't call path_put() under
> namespace semaphore") from Sep 19, 2025 (linux-next), leads to the
> following Smatch static checker warning:

Thank you, I will handle this.