On Wed, Sep 10, 2025 at 04:36:59PM +0200, Christian Brauner wrote:
@@ -573,6 +588,7 @@ struct net *copy_net_ns(unsigned long flags,if (rv < 0) { put_userns: + ns_free_inum(&net->ns);
I've ended up looking at this patch because of Jan's earlier comment about a different issue in this patch. Aren't we double-freeing net->ns here if setup_net() failed? setup_net() can call ops_undo_list() on failure, which will ns_free_inum(&net->ns) once, and then we do it again in the put_userns error handling label. -- Thanks, Sasha
