Re: [PATCH v3 01/12] ns: Free anonymous mount namespaces via ns_common_free()

Christian Brauner <[email protected]> Thu, 30 Jul 2026 12:44:35 +0200
Newsgroups gmane.linux.file-systems,gmane.linux.kernel,gmane.linux.kernel.lsm
Message-ID <20260730-miterleben-minuten-komma-91fdfa5aaec7@brauner>
Hi Mickaël,

> free_mnt_ns() skipped ns_common_free() for anonymous mount namespaces
> (the "if (!is_anon_ns(ns))" guard) because they carry the reserved inum
> MNT_NS_ANON_INO, which proc_free_inum() must never release.
> 
> A following change needs ns_common_free() to run for every namespace, to
> release per-namespace state attached during __ns_common_init().  Move
> the reserved-inum decision into __ns_common_free() and let free_mnt_ns()
> call ns_common_free() unconditionally.
> 
> __ns_common_free() is shared by all namespace types, so it gates
> proc_free_inum() on ns->inum > MNT_NS_INO_SPECIAL_MAX (a new alias for
> MNT_NS_ANON_INO) rather than the mount-specific is_anon_ns().  The
> reserved inums (MNT_NS_ANON_INO and the *_NS_INIT_INO values just above
> it) belong to namespaces that are never freed, except the anonymous
> mount namespace; dynamically allocated inums are >= PROC_DYNAMIC_FIRST.
> So the comparison frees every dynamic inum and skips exactly the
> anonymous mount namespace, matching the previous guard.
> 
> Cc: Günther Noack <[email protected]>
> Cc: Paul Moore <[email protected]>
> Co-developed-by: Mickaël Salaün <[email protected]>
> Signed-off-by: Mickaël Salaün <[email protected]>

Seems good,
Reviewed-by: Christian Brauner (Amutable) <[email protected]>

--