[PATCH v3 01/12] ns: Free anonymous mount namespaces via ns_common_free()
Christian Brauner
brauner at kernel.org
Thu Jul 30 10:44:35 UTC 2026
Hi Mickaël,
> free_mnt_ns() skipped ns_common_free() for anonymous mount namespaces
> (the "if (!is_anon_ns(ns))" guard) because they carry the reserved inum
> MNT_NS_ANON_INO, which proc_free_inum() must never release.
>
> A following change needs ns_common_free() to run for every namespace, to
> release per-namespace state attached during __ns_common_init(). Move
> the reserved-inum decision into __ns_common_free() and let free_mnt_ns()
> call ns_common_free() unconditionally.
>
> __ns_common_free() is shared by all namespace types, so it gates
> proc_free_inum() on ns->inum > MNT_NS_INO_SPECIAL_MAX (a new alias for
> MNT_NS_ANON_INO) rather than the mount-specific is_anon_ns(). The
> reserved inums (MNT_NS_ANON_INO and the *_NS_INIT_INO values just above
> it) belong to namespaces that are never freed, except the anonymous
> mount namespace; dynamically allocated inums are >= PROC_DYNAMIC_FIRST.
> So the comparison frees every dynamic inum and skips exactly the
> anonymous mount namespace, matching the previous guard.
>
> Cc: Günther Noack <gnoack at google.com>
> Cc: Paul Moore <paul at paul-moore.com>
> Co-developed-by: Mickaël Salaün <mic at digikod.net>
> Signed-off-by: Mickaël Salaün <mic at digikod.net>
Seems good,
Reviewed-by: Christian Brauner (Amutable) <brauner at kernel.org>
--
More information about the Linux-security-module-archive
mailing list