Re: [PATCH] proc: Fix broken error paths for namespace links

[Magnus Lindholm]

On Mon, Jul 6, 2026 at 8:22 PM Jann Horn <jannh@xxxxxxxxxx> wrote:
>
> Don't return the return value of down_read_killable() (0) when a ptrace
> access check fails, return -EACCES as intended.
>
> Reported-by: Magnus Lindholm <linmag7@xxxxxxxxx>
> Closes: https://lore.kernel.org/r/20260706170735.2941493-1-linmag7@xxxxxxxxx
> Fixes: 6650527444da ("proc: protect ptrace_may_access() with exec_update_lock (part 1)")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Jann Horn <jannh@xxxxxxxxxx>
> ---
>  fs/proc/namespaces.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/fs/proc/namespaces.c b/fs/proc/namespaces.c
> index 2f46f1396744..ea6ec61a0430 100644
> --- a/fs/proc/namespaces.c
> +++ b/fs/proc/namespaces.c
> @@ -46,7 +46,7 @@ static const char *proc_ns_get_link(struct dentry *dentry,
>         const struct proc_ns_operations *ns_ops = PROC_I(inode)->ns_ops;
>         struct task_struct *task;
>         struct path ns_path;
> -       int error = -EACCES;
> +       int error;
>
>         if (!dentry)
>                 return ERR_PTR(-ECHILD);
> @@ -59,6 +59,7 @@ static const char *proc_ns_get_link(struct dentry *dentry,
>         if (error)
>                 goto out_put_task;
>
> +       error = -EACCES;
>         if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS))
>                 goto out;
>
> @@ -90,6 +91,7 @@ static int proc_ns_readlink(struct dentry *dentry, char __user *buffer, int bufl
>         if (res)
>                 goto out_put_task;
>
> +       res = -EACCES;
>         if (ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS)) {
>                 res = ns_get_name(name, sizeof(name), task, ns_ops);
>                 if (res >= 0)
>
> ---
> base-commit: 8cdeaa50eae8dad34885515f62559ee83e7e8dda
> change-id: 20260706-procfs-ns-eacces-fix-3abd8e307936
>
> Best regards,
> --
> Jann Horn <jannh@xxxxxxxxxx>
>

Hi Jann,

Thanks for the quick fix. I applied this on top of v7.2-rc1 together with
my Alpha generic-entry series, and the strace testsuite is back to the
expected state. In particular, the --pidns-translation tests that previously
failed due to strace seeing ENOTTY from the namespace fd now pass again.

Tested-by: Magnus Lindholm linmag7@xxxxxxxxx

Thanks,
Magnus