On Mon, Sep 15, 2025 at 01:07:06PM +0200, Jan Kara wrote:
> On Fri 12-09-25 13:52:34, Christian Brauner wrote:
> > Don't cargo-cult the same thing over and over.
> > 
> > Signed-off-by: Christian Brauner <[email protected]>
> 
> ...
> 
> > @@ -559,7 +572,9 @@ struct net *copy_net_ns(unsigned long flags,
> >             goto dec_ucounts;
> >     }
> >  
> > -   preinit_net(net, user_ns);
> > +   rv = preinit_net(net, user_ns);
> > +   if (rv < 0)
> > +           goto dec_ucounts;
> 
> Umm, this seems to be leaking 'net' on error exit.

Sorry about this:

diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 5fb7bd8ac45a..466de530c495 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -572,12 +572,13 @@ struct net *copy_net_ns(unsigned long flags,
                goto dec_ucounts;
        }

-       rv = preinit_net(net, user_ns);
-       if (rv < 0)
-               goto dec_ucounts;
        net->ucounts = ucounts;
        get_user_ns(user_ns);

+       rv = preinit_net(net, user_ns);
+       if (rv < 0)
+               goto put_userns;
+
        rv = down_read_killable(&pernet_ops_rwsem);
        if (rv < 0)
                goto put_userns;

Thanks for noticing! Fixed in-tree.

Reply via email to