Re: [PATCH Next] copy_mnt_ns(): Remove unnecessary unlock

[Christian Brauner <brauner@kernel.org>]

On Wed, Sep 24, 2025 at 06:56:41PM +0100, Al Viro wrote:
> On Wed, Sep 24, 2025 at 02:03:56PM +0200, Jan Kara wrote:
> > On Wed 24-09-25 18:29:04, Edward Adam Davis wrote:
> > > This code segment is already protected by guards, namespace_unlock()
> > > should not appear here.
> > > 
> > > Reported-by: syzbot+0d671007a95cd2835e05@syzkaller.appspotmail.com
> > > Closes: https://syzkaller.appspot.com/bug?extid=0d671007a95cd2835e05
> > > Signed-off-by: Edward Adam Davis <eadavis@qq.com>
> > 
> > Indeed. Feel free to add:
> > 
> > Reviewed-by: Jan Kara <jack@suse.cz>
> 
> I wonder where does that line come from, though.  Mismerge somewhere?
> d7b7253a0adc "copy_mnt_ns(): use guards" includes this:
> 
> @@ -4185,13 +4186,11 @@ struct mnt_namespace *copy_mnt_ns(unsigned long flags, struct mnt_namespace *ns,
>  	new = copy_tree(old, old->mnt.mnt_root, copy_flags);
>  	if (IS_ERR(new)) {
>  		emptied_ns = new_ns;
> -		namespace_unlock();
>  		return ERR_CAST(new);
>  	}
>  	if (user_ns != ns->user_ns) {
> -		lock_mount_hash();
> +		guard(mount_writer)();
>  		lock_mnt_tree(new);
> -		unlock_mount_hash();
>  	}
>  	new_ns->root = new;
>  

Fwiw, I just pulled next-20250926 and I don't see this bug. So I'm not
sure it's even a merge conflict or it was in an earlier -next version.