[PATCH] fs: tmpfile_create(): add missing mntget()

[PATCH] fs: tmpfile_create(): add missing mntget()

[Sascha Hauer]

tmpfile_create() assigns the parentpath->mnt to the new file's path
without mntget() it, so we'll get unbalanced reference count when
the tmpfile is closed. Add the missing mntget().

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 fs/fs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/fs.c b/fs/fs.c
index 75fd3a3ef9..43840c3a7a 100644
--- a/fs/fs.c
+++ b/fs/fs.c
@@ -2675,6 +2675,7 @@ static struct file *tmpfile_create(const struct path *parentpath,
 	if (!f)
 		return ERR_PTR(-EMFILE);
 
+	mntget(parentpath->mnt);
 	f->f_path.mnt = parentpath->mnt;
 	f->f_path.dentry = d_alloc_anon(&fsdev->sb);
 	f->f_flags = flags;
-- 
2.47.3

Re: [PATCH] fs: tmpfile_create(): add missing mntget()

[Sascha Hauer]

On Mon, Jan 19, 2026 at 10:46:17AM +0100, Sascha Hauer wrote:
> tmpfile_create() assigns the parentpath->mnt to the new file's path
> without mntget() it, so we'll get unbalanced reference count when
> the tmpfile is closed. Add the missing mntget().

git blame points to:

e5591127b7 ("fs: allocate inodes for O_TMPFILE-created files")

I am not really sure though if the issue was there before the patch.

Sascha

> 
> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
> ---
>  fs/fs.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/fs/fs.c b/fs/fs.c
> index 75fd3a3ef9..43840c3a7a 100644
> --- a/fs/fs.c
> +++ b/fs/fs.c
> @@ -2675,6 +2675,7 @@ static struct file *tmpfile_create(const struct path *parentpath,
>  	if (!f)
>  		return ERR_PTR(-EMFILE);
>  
> +	mntget(parentpath->mnt);
>  	f->f_path.mnt = parentpath->mnt;
>  	f->f_path.dentry = d_alloc_anon(&fsdev->sb);
>  	f->f_flags = flags;
> -- 
> 2.47.3
> 
> 

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

Re: [PATCH] fs: tmpfile_create(): add missing mntget()

[Sascha Hauer]

On Mon, 19 Jan 2026 10:46:17 +0100, Sascha Hauer wrote:
> tmpfile_create() assigns the parentpath->mnt to the new file's path
> without mntget() it, so we'll get unbalanced reference count when
> the tmpfile is closed. Add the missing mntget().
> 
> 

Applied, thanks!

[1/1] fs: tmpfile_create(): add missing mntget()
      https://git.pengutronix.de/cgit/barebox/commit/?id=4f3aee3f1c60 (link may not be stable)

Best regards,
-- 
Sascha Hauer <s.hauer@pengutronix.de>