Re: [PATCH] fork: fix active reference underflow on unshare() failure

[Christian Brauner]

On Sun, Sep 27, 2026 at 08:33:57PM +0200, Pavel Tikhomirov wrote:
> 
> 
> On 9/27/26 11:54, Tao Cui wrote:
> > From: Tao Cui <cuitao@xxxxxxxxxx>
> > 
> > When set_cred_ucounts() fails in ksys_unshare() the new nsproxy is
> > released with put_nsproxy().  But the nsproxy has not been installed
> > at this point; it is only marked as active once
> > switch_task_namespaces() installs it, which happens after all failure
> > points.  Dropping the last reference therefore deactivates it and
> > puts the active reference of every namespace it points to: for
> > namespaces created by this unshare() call the active count underflows
> > to -1, and for namespaces carried over from the caller a live active
> > reference of the still-running task is dropped, which makes them
> > disappear from nsfs file handles and listns and causes a cascading
> > underflow at task exit.
> > 
> > Use nsproxy_free() on this error path, which drops the regular
> > references without touching the active ones, like the setns() failure
> > paths already do; see commit cefd55bd2159 ("nsproxy: fix
> > free_nsproxy() and simplify create_new_namespaces()").
> > 
> > Fixes: a98621a0f187a ("unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure")
> > Link: https://lore.kernel.org/r/20251118064552.936962-1-ptikhomirov@xxxxxxxxxxxxx
> > Link: https://lore.kernel.org/r/20260213193959.2556730-1-mge@xxxxxxxx
> 
> Reviewed-by: Pavel Tikhomirov <ptikhomirov@xxxxxxxxxxxxx>

Thanks, already fixed upstream! :)