From 4f238e6e1c2cc985ca6885549e05de8fc37ad4fe Mon Sep 17 00:00:00 2001 From: Christian Brauner Date: Sun, 26 Jul 2026 18:13:46 +0200 Subject: ns: Free anonymous mount namespaces via ns_common_free() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit free_mnt_ns() skipped ns_common_free() for anonymous mount namespaces (the "if (!is_anon_ns(ns))" guard) because they carry the reserved inum MNT_NS_ANON_INO, which proc_free_inum() must never release. A following change needs ns_common_free() to run for every namespace, to release per-namespace state attached during __ns_common_init(). Move the reserved-inum decision into __ns_common_free() and let free_mnt_ns() call ns_common_free() unconditionally. __ns_common_free() is shared by all namespace types, so it gates proc_free_inum() on ns->inum > MNT_NS_INO_SPECIAL_MAX (a new alias for MNT_NS_ANON_INO) rather than the mount-specific is_anon_ns(). The reserved inums (MNT_NS_ANON_INO and the *_NS_INIT_INO values just above it) belong to namespaces that are never freed, except the anonymous mount namespace; dynamically allocated inums are >= PROC_DYNAMIC_FIRST. So the comparison frees every dynamic inum and skips exactly the anonymous mount namespace, matching the previous guard. Cc: Günther Noack Cc: Paul Moore Signed-off-by: Christian Brauner Co-developed-by: Mickaël Salaün Signed-off-by: Mickaël Salaün Reviewed-by: Christian Brauner (Amutable) Signed-off-by: Paul Moore --- include/uapi/linux/nsfs.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include/uapi/linux') diff --git a/include/uapi/linux/nsfs.h b/include/uapi/linux/nsfs.h index 007fed5971b4..e5909266ec3f 100644 --- a/include/uapi/linux/nsfs.h +++ b/include/uapi/linux/nsfs.h @@ -55,6 +55,7 @@ enum init_ns_ino { MNT_NS_INIT_INO = 0xEFFFFFF8U, #ifdef __KERNEL__ MNT_NS_ANON_INO = 0xEFFFFFF7U, + MNT_NS_INO_SPECIAL_MAX = MNT_NS_ANON_INO, #endif }; -- cgit v1.2.3