From a244eff8ad49363a4efa2d732f9636c02976aab1 Mon Sep 17 00:00:00 2001 From: Ayush Ranjan Date: Fri, 24 May 2024 14:25:22 -0700 Subject: [PATCH] Fix mount namespace ref leak during executeAsync() when ResolveEnvs() fails. Fixes 7e462a1c7f56 ("OCI spec may contain duplicate environment variables"). PiperOrigin-RevId: 637033998 --- runsc/boot/loader.go | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/runsc/boot/loader.go b/runsc/boot/loader.go index 34193e7aa..746fbfb47 100644 --- a/runsc/boot/loader.go +++ b/runsc/boot/loader.go @@ -1230,6 +1230,11 @@ func (l *Loader) executeAsync(args *control.ExecArgs) (kernel.ThreadID, error) { if args.MountNamespace == nil || !args.MountNamespace.TryIncRef() { return 0, fmt.Errorf("container %q has stopped", args.ContainerID) } + sctx := l.k.SupervisorContext() + root := args.MountNamespace.Root(sctx) + defer root.DecRef(sctx) + ctx := vfs.WithRoot(sctx, root) + defer args.MountNamespace.DecRef(ctx) args.Envv, err = specutils.ResolveEnvs(args.Envv) if err != nil { @@ -1237,11 +1242,6 @@ func (l *Loader) executeAsync(args *control.ExecArgs) (kernel.ThreadID, error) { } // Add the HOME environment variable if it is not already set. - sctx := l.k.SupervisorContext() - root := args.MountNamespace.Root(sctx) - defer root.DecRef(sctx) - ctx := vfs.WithRoot(sctx, root) - defer args.MountNamespace.DecRef(ctx) args.Envv, err = user.MaybeAddExecUserHome(ctx, args.MountNamespace, args.KUID, args.Envv) if err != nil { return 0, err