From 652eed77988978b7d80c9b75dec36671e2ec250e Mon Sep 17 00:00:00 2001 From: Hui Peng Date: Sat, 19 Sep 2026 11:25:18 +0000 Subject: [PATCH 1/2] nsfs: fix u32-vs-bytes unit mismatch in nsfs_fh_to_dentry() In nsfs_fh_to_dentry(), both fh_len and NSFS_FID_SIZE_U32_LATEST (4) are expressed in units of 4-byte u32 words rather than bytes, whereas pointer arithmetic on (void *)fid and the byte count passed to memchr_inv() are in bytes (NSFS_FILE_HANDLE_SIZE_LATEST = 16). Passing (void *)fid + NSFS_FID_SIZE_U32_LATEST and fh_len - NSFS_FID_SIZE_U32_LATEST to memchr_inv() inspects bytes [4 .. fh_len) inside struct nsfs_file_handle (fid->ns_id and fid->ns_type) instead of the trailing bytes [16 .. fh_len * 4) after struct nsfs_file_handle. Consequently: 1. Valid zero-padded handles with handle_bytes >= 36 (fh_len >= 9) where fid->ns_type != 0 (at byte offset 8) are falsely rejected with -ESTALE. 2. Non-zero trailing garbage in bytes [16 .. fh_len * 4) is ignored when the upper 32 bits of fid->ns_id (bytes [4..7]) are zero. Fix this by offsetting (void *)fid by NSFS_FILE_HANDLE_SIZE_LATEST (16) and multiplying (fh_len - NSFS_FID_SIZE_U32_LATEST) by sizeof(u32). Fixes: 5222470b2fbb ("nsfs: support file handles") Assisted-by: LLM Signed-off-by: Hui Peng --- fs/nsfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/nsfs.c b/fs/nsfs.c index c3b6ae76594a8..0ef4e1455b7a0 100644 --- a/fs/nsfs.c +++ b/fs/nsfs.c @@ -529,8 +529,8 @@ static struct dentry *nsfs_fh_to_dentry(struct super_block *sb, struct fid *fh, /* Check that any trailing bytes are zero. */ if ((fh_len > NSFS_FID_SIZE_U32_LATEST) && - memchr_inv((void *)fid + NSFS_FID_SIZE_U32_LATEST, 0, - fh_len - NSFS_FID_SIZE_U32_LATEST)) + memchr_inv((void *)fid + NSFS_FILE_HANDLE_SIZE_LATEST, 0, + (fh_len - NSFS_FID_SIZE_U32_LATEST) * sizeof(u32))) return NULL; switch (fh_type) { From f442bd37bd040ef1ccdf9f9d603c02a82a836492 Mon Sep 17 00:00:00 2001 From: Hui Peng Date: Sat, 19 Sep 2026 11:25:19 +0000 Subject: [PATCH 2/2] nsfs: fix namespace reference leak on unsupported ns_type in nsfs_fh_to_dentry() In nsfs_fh_to_dentry(), ns_get_unless_inactive(ns) acquires an active reference to ns before switching on ns->ns_type. Unlike the CLONE_NEWPID error path and the owning_ns permission error path, the default: branch returns ERR_PTR(-EOPNOTSUPP) without calling ns->ops->put(ns), leaking the namespace reference. Call ns->ops->put(ns) before returning ERR_PTR(-EOPNOTSUPP) in the default: branch. Fixes: 5222470b2fbb ("nsfs: support file handles") Assisted-by: LLM Signed-off-by: Hui Peng --- fs/nsfs.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/nsfs.c b/fs/nsfs.c index 0ef4e1455b7a0..e9cc09583a915 100644 --- a/fs/nsfs.c +++ b/fs/nsfs.c @@ -624,6 +624,7 @@ static struct dentry *nsfs_fh_to_dentry(struct super_block *sb, struct fid *fh, break; #endif default: + ns->ops->put(ns); return ERR_PTR(-EOPNOTSUPP); }