mq_init_ns() creates the mqueue mount with fc_mount_longterm(), so its
->mnt_ns is MNT_NS_INTERNAL. When setting up the mqueue or ipc sysctls
or msg_init_ns() fails afterwards, create_ipc_ns() drops it with a plain
mntput(). With ->mnt_ns set that takes the fast path of
mntput_no_expire(). The count drops to zero and nothing ever kills the
mount, so the mount and the mqueue superblock are leaked.

Commit dc55e35f9e81 ("ipc: Store mqueue sysctls in the ipc namespace")
added the first failure path after mq_init_ns() and never dropped the
mount. Commit 7229d74e5e8c ("ipc: create_ipc_ns: drop mqueue mount on
sysctl setup failure") tried to fix that with a mntput() but that
doesn't help for a long-term mount.

Use kern_unmount(). free_ipc() open-codes the same thing for a namespace
that made it.

Fixes: dc55e35f9e81 ("ipc: Store mqueue sysctls in the ipc namespace")
Fixes: 7229d74e5e8c ("ipc: create_ipc_ns: drop mqueue mount on sysctl setup failure")
Cc: stable@vger.kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
---
Reproducer: repro.c fails each slab allocation of unshare(CLONE_NEWIPC)
in turn with fail-nth, a hundred rounds. It needs CONFIG_FAILSLAB and
CONFIG_FAULT_INJECTION_DEBUG_FS and runs as root.

    echo N > /sys/kernel/debug/failslab/ignore-gfp-wait
    echo 0 > /sys/kernel/debug/failslab/verbose
    echo 2 > /proc/sys/vm/drop_caches; cat /proc/sys/fs/inode-nr
    ./repro 100
    sleep 2
    echo 2 > /proc/sys/vm/drop_caches; cat /proc/sys/fs/inode-nr

Every failure in setup_mq_sysctls() and setup_ipc_sysctls() leaves an
mqueue superblock behind with its root inode, about seven per round.
Without this patch inode-nr goes from 967 to 1678, with it it stays at
967.

repro.c:

    #define _GNU_SOURCE
    #include <fcntl.h>
    #include <sched.h>
    #include <stdio.h>
    #include <stdlib.h>
    #include <string.h>
    #include <sys/wait.h>
    #include <unistd.h>

    /*
     * Fail the nth slab allocation of unshare(CLONE_NEWIPC). Returns 1 once
     * nth is past the last one: nothing was injected and unshare() worked.
     */
    static int last(int nth)
    {
    	int status;

    	if (!fork()) {
    		char buf[16] = "";
    		int fd, ret;

    		fd = open("/proc/thread-self/fail-nth", O_RDWR);
    		snprintf(buf, sizeof(buf), "%d", nth);
    		write(fd, buf, strlen(buf));
    		ret = unshare(CLONE_NEWIPC);
    		pread(fd, buf, sizeof(buf) - 1, 0);
    		_exit(!ret && atoi(buf));
    	}
    	wait(&status);
    	return WEXITSTATUS(status);
    }

    int main(int argc, char *argv[])
    {
    	for (int i = 0; i < atoi(argv[1]); i++)
    		for (int nth = 1; !last(nth); nth++)
    			;
    	return 0;
    }
---
 ipc/namespace.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ipc/namespace.c b/ipc/namespace.c
index 1e71353bdb4a..75aa7b469348 100644
--- a/ipc/namespace.c
+++ b/ipc/namespace.c
@@ -96,7 +96,7 @@ static struct ipc_namespace *create_ipc_ns(struct user_namespace *user_ns,
 fail_mq_sysctls:
 	retire_mq_sysctls(ns);
 fail_mq_mount:
-	mntput(ns->mq_mnt);
+	kern_unmount(ns->mq_mnt);
 fail_put:
 	put_user_ns(ns->user_ns);
 	ns_common_free(ns);

-- 
2.53.0