From 76ebb69da677d2a4c5e59bf758b6424d511f5684 Mon Sep 17 00:00:00 2001 From: Christian Brauner Date: Thu, 17 Sep 2026 13:49:03 +0200 Subject: [PATCH 1/2] Revert "selftests/filesystems: add mntns cleanup test" This reverts commit 3452eecbcc954ef859b7d19309c121a78d6d0e31. The test checks that the mounts of a destroyed mount namespace stay connected. The commit that made them stay connected is reverted next because it leaks superblocks and loop devices, so drop the test with it. Link: https://patch.msgid.link/20260917-work-put_mnt_ns-revert-v1-1-34d9b8679e68@kernel.org Signed-off-by: Christian Brauner (Amutable) --- tools/testing/selftests/Makefile | 1 - .../filesystems/mntns_cleanup/.gitignore | 2 - .../filesystems/mntns_cleanup/Makefile | 6 -- .../mntns_cleanup/mntns_cleanup_test.c | 58 ------------------- 4 files changed, 67 deletions(-) delete mode 100644 tools/testing/selftests/filesystems/mntns_cleanup/.gitignore delete mode 100644 tools/testing/selftests/filesystems/mntns_cleanup/Makefile delete mode 100644 tools/testing/selftests/filesystems/mntns_cleanup/mntns_cleanup_test.c diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile index 330d061f6366..273853937c25 100644 --- a/tools/testing/selftests/Makefile +++ b/tools/testing/selftests/Makefile @@ -49,7 +49,6 @@ TARGETS += filesystems/move_mount TARGETS += filesystems/empty_mntns TARGETS += filesystems/fsmount_ns TARGETS += filesystems/fscontext_ns -TARGETS += filesystems/mntns_cleanup TARGETS += filesystems/xattr TARGETS += firmware TARGETS += fpu diff --git a/tools/testing/selftests/filesystems/mntns_cleanup/.gitignore b/tools/testing/selftests/filesystems/mntns_cleanup/.gitignore deleted file mode 100644 index 493fbcf8d9ec..000000000000 --- a/tools/testing/selftests/filesystems/mntns_cleanup/.gitignore +++ /dev/null @@ -1,2 +0,0 @@ -# SPDX-License-Identifier: GPL-2.0-only -mntns_cleanup_test diff --git a/tools/testing/selftests/filesystems/mntns_cleanup/Makefile b/tools/testing/selftests/filesystems/mntns_cleanup/Makefile deleted file mode 100644 index 0e09e7030a5c..000000000000 --- a/tools/testing/selftests/filesystems/mntns_cleanup/Makefile +++ /dev/null @@ -1,6 +0,0 @@ -# SPDX-License-Identifier: GPL-2.0 -TEST_GEN_PROGS := mntns_cleanup_test - -CFLAGS += -Wall -O2 -g $(KHDR_INCLUDES) - -include ../../lib.mk diff --git a/tools/testing/selftests/filesystems/mntns_cleanup/mntns_cleanup_test.c b/tools/testing/selftests/filesystems/mntns_cleanup/mntns_cleanup_test.c deleted file mode 100644 index 5209712568b1..000000000000 --- a/tools/testing/selftests/filesystems/mntns_cleanup/mntns_cleanup_test.c +++ /dev/null @@ -1,58 +0,0 @@ -// SPDX-License-Identifier: GPL-2.0 - -#define _GNU_SOURCE -#include -#include -#include -#include -#include -#include - -#include "../../kselftest_harness.h" - -FIXTURE(mntns_cleanup) { -}; - -FIXTURE_SETUP(mntns_cleanup) -{ - if (geteuid() != 0) - SKIP(return, "test requires CAP_SYS_ADMIN"); - - ASSERT_EQ(unshare(CLONE_NEWNS), 0); - ASSERT_EQ(mount("", "/", NULL, MS_REC | MS_PRIVATE, NULL), 0); - - rmdir("/mnt_dir"); - ASSERT_EQ(mkdir("/mnt_dir", 0755), 0); - ASSERT_EQ(mount("tmpfs", "/mnt_dir", "tmpfs", 0, NULL), 0); - ASSERT_EQ(mkdir("/mnt_dir/hidden", 0755), 0); - ASSERT_EQ(mkdir("/mnt_dir/hidden/secret", 0755), 0); - ASSERT_EQ(mount("tmpfs", "/mnt_dir/hidden", "tmpfs", 0, NULL), 0); -} - -FIXTURE_TEARDOWN(mntns_cleanup) -{ -} - -/* Mounts must stay connected when a mount namespace is cleaned up. */ -TEST_F(mntns_cleanup, keeps_mounts_connected) -{ - int fd, sfd, err; - - fd = open("/mnt_dir", O_PATH | O_DIRECTORY | O_CLOEXEC); - ASSERT_GE(fd, 0); - - /* Destroy the namespace; the fd keeps /mnt_dir alive. */ - ASSERT_EQ(unshare(CLONE_NEWNS), 0); - - sfd = openat(fd, "hidden/secret", O_RDONLY); - err = errno; - if (sfd >= 0) - close(sfd); - close(fd); - - ASSERT_LT(sfd, 0) - TH_LOG("mount namespace teardown revealed what the overmount covered"); - ASSERT_EQ(err, ENOENT); -} - -TEST_HARNESS_MAIN From 2e2142a35d809c3cc726d3b39e7aeee98d9ab71c Mon Sep 17 00:00:00 2001 From: Christian Brauner Date: Thu, 17 Sep 2026 13:49:04 +0200 Subject: [PATCH 2/2] Revert "put_mnt_ns(): leave mounts connected" This reverts commit 0342482a4d15358fe6931606caf58968de5d1d38. Keeping every mount of a dying namespace attached to its parent changes who owns it. An attached but unmounted mount is owned by its parent: the parent's final mntput() is what drops the child's reference and takes its superblock down. Before that commit only the namespace root was in that position and every other mount dropped its own reference in namespace_unlock(). That ownership rule turns any reference from a child's superblock back to one of its ancestors into a cycle. The obvious case is a loop device: unshare -m sh -c 'mount -o loop /var/tmp/img /var/tmp/mp' mount(8) opens the image from inside the new namespace, so the loop device's backing file pins that namespace's copy of the root mount. When the namespace dies the loop mount stays attached to that copy and is owned by it. The copy can't reach zero because the backing file holds it. The backing file is only put once the ext4 superblock releases the block device and autoclear runs, and that needs the loop mount to go first. Nothing breaks the cycle. The superblock, the loop device and, since the root copy keeps all of its children. systemd-sysext sets up its loop devices in a private mount namespace and relies on autoclear when that namespace goes away, which is how this was found. Anything that holds a file on an ancestor from a mounted filesystem has the same problem. That includes ecryptfs lower paths, erofs file-backed mounts, fuse passthrough backing files. That's a bigger fix and not an -rc change. Revert. Fixes: 0342482a4d15 ("put_mnt_ns(): leave mounts connected") Reported-by: Michael Vogt Link: https://gist.github.com/mvo5/63ef46482349f3b1c3957d463a0c9c6f Link: https://patch.msgid.link/20260917-work-put_mnt_ns-revert-v1-2-34d9b8679e68@kernel.org Signed-off-by: Christian Brauner (Amutable) --- fs/namespace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/namespace.c b/fs/namespace.c index 5e41021eaa63..580877e46b1a 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -6301,7 +6301,7 @@ void put_mnt_ns(struct mnt_namespace *ns) guard(namespace_excl)(); emptied_ns = ns; guard(mount_writer)(); - umount_tree(ns->root, UMOUNT_CONNECTED); + umount_tree(ns->root, 0); } struct vfsmount *kern_mount(struct file_system_type *type)