From: Al Viro <viro@zeniv.linux.org.uk>

commit 6dd3c6884cd9defb511284b566cef5ac8f657dbf upstream.

One should *not* be allowed to mount one of those, new API or not.

Reported-by: Denis Arefev <arefev@swemel.ru>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Link: https://patch.msgid.link/20260602020444.GP2636677@ZenIV
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
[Denis: rename new_mnt -> newmount.mnt]
[Denis: use goto err_unlock instead of direct return]
Signed-off-by: Denis Arefev <arefev@swemel.ru>
---
 fs/namespace.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/namespace.c b/fs/namespace.c
index 94c06c842902..a596381dba1c 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -4229,6 +4229,11 @@ SYSCALL_DEFINE3(fsmount, int, fs_fd, unsigned int, flags,
 		ret = PTR_ERR(newmount.mnt);
 		goto err_unlock;
 	}
+	if (newmount.mnt->mnt_sb->s_flags & SB_NOUSER) {
+		mntput(newmount.mnt);
+		ret = -EINVAL;
+		goto err_unlock;
+	}
 	newmount.dentry = dget(fc->root);
 	newmount.mnt->mnt_flags = mnt_flags;
 
-- 
2.43.0

On Fri, Aug 07, 2026 at 01:38:27PM +0300, Denis Arefev wrote:
>From: Al Viro <viro@zeniv.linux.org.uk>
>
>commit 6dd3c6884cd9defb511284b566cef5ac8f657dbf upstream.
>
>One should *not* be allowed to mount one of those, new API or not.

Queued for 5.10, 5.15, 6.1, 6.6, 6.12 and 6.18, thanks.

-- 
Thanks,
Sasha