Re: [PATCH] fork: fix active reference underflow on unshare() failure

[Pavel Tikhomirov]

On 9/27/26 11:54, Tao Cui wrote:
> From: Tao Cui <cuitao@xxxxxxxxxx>
> 
> When set_cred_ucounts() fails in ksys_unshare() the new nsproxy is
> released with put_nsproxy().  But the nsproxy has not been installed
> at this point; it is only marked as active once
> switch_task_namespaces() installs it, which happens after all failure
> points.  Dropping the last reference therefore deactivates it and
> puts the active reference of every namespace it points to: for
> namespaces created by this unshare() call the active count underflows
> to -1, and for namespaces carried over from the caller a live active
> reference of the still-running task is dropped, which makes them
> disappear from nsfs file handles and listns and causes a cascading
> underflow at task exit.
> 
> Use nsproxy_free() on this error path, which drops the regular
> references without touching the active ones, like the setns() failure
> paths already do; see commit cefd55bd2159 ("nsproxy: fix
> free_nsproxy() and simplify create_new_namespaces()").
> 
> Fixes: a98621a0f187a ("unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure")
> Link: https://lore.kernel.org/r/20251118064552.936962-1-ptikhomirov@xxxxxxxxxxxxx
> Link: https://lore.kernel.org/r/20260213193959.2556730-1-mge@xxxxxxxx

Reviewed-by: Pavel Tikhomirov <ptikhomirov@xxxxxxxxxxxxx>

> Signed-off-by: Tao Cui <cuitao@xxxxxxxxxx>
> ---
>  include/linux/nsproxy.h | 1 +
>  kernel/fork.c           | 2 +-
>  kernel/nsproxy.c        | 2 +-
>  3 files changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/include/linux/nsproxy.h b/include/linux/nsproxy.h
> index 5a67648721c7d..dc2447f5f0924 100644
> --- a/include/linux/nsproxy.h
> +++ b/include/linux/nsproxy.h
> @@ -100,6 +100,7 @@ void exit_cred_namespaces(struct task_struct *tsk);
>  void switch_task_namespaces(struct task_struct *tsk, struct nsproxy *new);
>  int exec_task_namespaces(void);
>  void deactivate_nsproxy(struct nsproxy *ns);
> +void nsproxy_free(struct nsproxy *ns);
>  int unshare_nsproxy_namespaces(unsigned long, struct nsproxy **,
>  	struct cred *, struct fs_struct *);
>  int __init nsproxy_cache_init(void);
> diff --git a/kernel/fork.c b/kernel/fork.c
> index d458d85d7a656..11e16554daa61 100644
> --- a/kernel/fork.c
> +++ b/kernel/fork.c
> @@ -3324,7 +3324,7 @@ int ksys_unshare(unsigned long unshare_flags)
>  
>  bad_unshare_cleanup_nsproxy:
>  	if (new_nsproxy)
> -		put_nsproxy(new_nsproxy);
> +		nsproxy_free(new_nsproxy);
>  bad_unshare_cleanup_cred:
>  	if (new_cred)
>  		put_cred(new_cred);
> diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c
> index 0f1b208d8eeff..454427b09ed97 100644
> --- a/kernel/nsproxy.c
> +++ b/kernel/nsproxy.c
> @@ -61,7 +61,7 @@ static inline struct nsproxy *create_nsproxy(void)
>  	return nsproxy;
>  }
>  
> -static inline void nsproxy_free(struct nsproxy *ns)
> +void nsproxy_free(struct nsproxy *ns)
>  {
>  	put_mnt_ns(ns->mnt_ns);
>  	put_uts_ns(ns->uts_ns);

-- 
Best regards, Pavel Tikhomirov
Senior Software Developer, Virtuozzo.