From: Christian Brauner <brauner@xxxxxxxxxx> commit 229fd15908fe1f99b1de4cde3326e62d1e892611 upstream. When copying a namespace we won't have added the new copy into the namespace rbtree until after the copy succeeded. Calling free_mnt_ns() will try to remove the copy from the rbtree which is invalid. Simply free the namespace skeleton directly. Link: https://lore.kernel.org/r/20241016-adapter-seilwinde-83c508a7bde1@brauner Fixes: 1901c92497bd ("fs: keep an index of current mount namespaces") Tested-by: Brad Spengler <spender@xxxxxxxxxxxxxx> Cc: stable@xxxxxxxxxxxxxxx # v6.11+ Reported-by: Brad Spengler <spender@xxxxxxxxxxxxxx> Suggested-by: Brad Spengler <spender@xxxxxxxxxxxxxx> Signed-off-by: Christian Brauner <brauner@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- fs/namespace.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/fs/namespace.c +++ b/fs/namespace.c @@ -3917,7 +3917,9 @@ struct mnt_namespace *copy_mnt_ns(unsign new = copy_tree(old, old->mnt.mnt_root, copy_flags); if (IS_ERR(new)) { namespace_unlock(); - free_mnt_ns(new_ns); + ns_free_inum(&new_ns->ns); + dec_mnt_namespaces(new_ns->ucounts); + mnt_ns_release(new_ns); return ERR_CAST(new); } if (user_ns != ns->user_ns) { Patches currently in stable-queue which might be from brauner@xxxxxxxxxx are queue-6.11/openat2-explicitly-return-e2big-for-usize-page_size.patch queue-6.11/fs-don-t-try-and-remove-empty-rbtree-node.patch queue-6.11/nilfs2-fix-kernel-bug-due-to-missing-clearing-of-buffer-delay-flag.patch
