[PATCH v2 2/2] nsfs: fix namespace reference leak on unsupported ns_type in nsfs_fh_to_dentry()

[Hui Peng]

In nsfs_fh_to_dentry(), ns_get_unless_inactive(ns) acquires an active
reference to ns before switching on ns->ns_type. Unlike the CLONE_NEWPID
error path and the owning_ns permission error path, the default: branch
returns ERR_PTR(-EOPNOTSUPP) without calling ns->ops->put(ns), leaking
the namespace reference.

Call ns->ops->put(ns) before returning ERR_PTR(-EOPNOTSUPP) in the
default: branch.

Fixes: 5222470b2fbb ("nsfs: support file handles")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@xxxxxxxxx>
---
v2: Add a Fixes: tag. I blamed the default: label and its return
separately from patch 1/2 to be sure: both come from 5222470b2fbb
("nsfs: support file handles"), and the asymmetry is present in the
original version - the sibling CLONE_NEWPID and ns_capable() error paths
both call ns->ops->put(ns), only default: does not. The two later
commits touching this switch, 4055526d3574 ("ns: move ns type into
struct ns_common") and 3a18f809184b ("ns: add active reference count"),
only change the switch expression and how the reference is taken; they
do not add or remove a put.

Please note I have no reproducer for this one and I am not claiming it
is currently reachable: ns comes from ns_tree_lookup_rcu(), which only
returns namespaces present in the ns tree, and every namespace type that
can exist in a given config has a matching case, gated by the same
CONFIG_* symbols. So default: looks dead today and this is really an
error-path-symmetry / future-proofing fix rather than a live leak.
Treat it accordingly for stable - I would not object to dropping the
Fixes: tag to keep AUTOSEL away from it, or to folding the three error
paths into a common goto out_put; if you prefer that shape.

 fs/nsfs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/nsfs.c b/fs/nsfs.c
index a1842e12f..e9cc09583 100644
--- a/fs/nsfs.c
+++ b/fs/nsfs.c
@@ -624,6 +624,7 @@
 		break;
 #endif
 	default:
+		ns->ops->put(ns);
 		return ERR_PTR(-EOPNOTSUPP);
 	}
 
-- 
2.43.0