From 1823b16fccf7df2b77af8c53ca0f631096484447 Mon Sep 17 00:00:00 2001 From: Lucas Manning Date: Wed, 30 Nov 2022 13:54:09 -0800 Subject: [PATCH] Clean up DecRefs in mount methods. connectMountAt consumes the references held by the VirtualDentries. Reported-by: syzbot+b415395b0b7186903700@syzkaller.appspotmail.com PiperOrigin-RevId: 492009947 --- pkg/sentry/vfs/mount.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/pkg/sentry/vfs/mount.go b/pkg/sentry/vfs/mount.go index afd302141..f0da76fff 100644 --- a/pkg/sentry/vfs/mount.go +++ b/pkg/sentry/vfs/mount.go @@ -275,6 +275,7 @@ func (vfs *VirtualFilesystem) ConnectMountAt(ctx context.Context, creds *auth.Cr defer cleanup.Clean() // Check if the new mount + all the propagation mounts puts us over the max. if uint32(len(tree)+1)+vd.mount.ns.mounts > MountMax { + vd.DecRef(ctx) return linuxerr.ENOSPC } if err := vfs.connectMountAt(ctx, mnt, vd); err != nil { @@ -399,10 +400,10 @@ func (vfs *VirtualFilesystem) BindAt(ctx context.Context, creds *auth.Credential // Checklocks doesn't work with anon functions. vfs.setPropagation(clone, Private) // +checklocksforce vfs.abortPropagationTree(ctx, tree) // +checklocksforce - targetVd.DecRef(ctx) }) defer cleanup.Clean() if uint32(1+len(tree))+targetVd.mount.ns.mounts > MountMax { + targetVd.DecRef(ctx) return nil, linuxerr.ENOSPC } if err := vfs.connectMountAt(ctx, clone, targetVd); err != nil {