github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-22 23:01:49 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

namespace: drop the file's reference first in dissolve_on_fput()

Browse Source 
A detached mount tree is held alive by a file. dissolve_on_fput()
unmounts the detached tree attached to that file.

Currently dissolve_on_fput() leaves the file's reference to the root of
the tree to the caller. So either __fput(), open_detached_copy(), or
fsmount() drop the mount.

That's backwards. The reference keeps the tree around and is dropped
when the tree is already gone. Instead, let dissolve_on_fput() the mount
and drop it after umount_tree() with namespace_sem still held. After
umount_tree() the mntput() is never the last reference and so the root
gets unmounted before its children.

Link: https://patch.msgid.link/20260926-work-mount-fixes-2-v1-8-f357abf3d17b@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
This commit is contained in:
Christian Brauner 2026-09-26 15:44:31 +02:00
parent 57088a37b2
commit 7253a6ff64
No known key found for this signature in database
GPG Key ID: 91C61BC06578DCA2
2 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
fs/file_table.c
View File

@ -520,7 +520,8 @@ static void __fput(struct file *file)
dput(dentry);
if (unlikely(mode & FMODE_NEED_UNMOUNT))
dissolve_on_fput(mnt);
mntput(mnt);
else
mntput(mnt);
out:
file_free(file);
}

9
fs/namespace.c
View File

@ -2312,9 +2312,11 @@ void drop_collected_paths(const struct path *paths, const struct path *prealloc)
static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *, bool);
/* Consumes the caller's reference to @mnt. */
void dissolve_on_fput(struct vfsmount *mnt)
{
struct mount *m = real_mount(mnt);
struct vfsmount *p __free(mntput) = mnt;
struct mount *m = real_mount(p);
/*
* m used to be the root of anon namespace; if it still is one,
@ -2339,6 +2341,7 @@ void dissolve_on_fput(struct vfsmount *mnt)
lock_mount_hash();
umount_tree(m, UMOUNT_CONNECTED);
unlock_mount_hash();
mntput(no_free_ptr(p));
}
}
@ -3109,7 +3112,7 @@ static struct file *open_detached_copy(struct path *path, unsigned int flags)
path->mnt = mntget(&ns->root->mnt);
file = dentry_open(path, O_PATH, current_cred());
if (IS_ERR(file))
dissolve_on_fput(path->mnt);
dissolve_on_fput(no_free_ptr(path->mnt));
else
file->f_mode |= FMODE_NEED_UNMOUNT;
return file;
@ -4566,7 +4569,7 @@ SYSCALL_DEFINE3(fsmount, int, fs_fd, unsigned int, flags,
FD_PREPARE(fdf, (flags & FSMOUNT_CLOEXEC) ? O_CLOEXEC : 0,
dentry_open(&new_path, O_PATH, fc->cred));
if (fdf.err) {
dissolve_on_fput(new_path.mnt);
dissolve_on_fput(no_free_ptr(new_path.mnt));
return fdf.err;
}