From 0342482a4d15358fe6931606caf58968de5d1d38 Mon Sep 17 00:00:00 2001 From: Noah Orlando Date: Mon, 6 Jul 2026 14:25:59 -0400 Subject: [PATCH] put_mnt_ns(): leave mounts connected When a mount namespace is destroyed, put_mnt_ns() disconnects its mounts from their mount points. A file descriptor still open on the parent of a mount point can then be used to look under the mount point. Locked mounts are kept connected to prevent this. However, a mount is only locked when its tree is copied across a user namespace boundary. A mount namespace set up by a privileged component has no locked mounts, so its mounts are disconnected. Pass UMOUNT_CONNECTED so every mount is kept connected, as locked mounts already are. Signed-off-by: Noah Orlando Link: https://patch.msgid.link/20260706182559.2496448-2-Noah.Orlando@deshaw.com Signed-off-by: Christian Brauner (Amutable) --- fs/namespace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/namespace.c b/fs/namespace.c index 3d5cd5bf3b05..a58c9d4ea25c 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -6283,7 +6283,7 @@ void put_mnt_ns(struct mnt_namespace *ns) guard(namespace_excl)(); emptied_ns = ns; guard(mount_writer)(); - umount_tree(ns->root, 0); + umount_tree(ns->root, UMOUNT_CONNECTED); } struct vfsmount *kern_mount(struct file_system_type *type)