Re: [PATCH] nstree: check listing permission before taking a namespace reference

[Bradley Morgan]

On 4 September 2026 15:28:05 BST, Norbert Szetei <norbert@xxxxxxxxxxxx>
wrote:
>legitimize_ns() takes a reference on the candidate namespace before
>may_list_ns() has decided whether the caller may see it. The
>__free(ns_put) cleanup on the denied path can drop the last reference to a
>mount namespace while we still hold the rcu read lock, and put_mnt_ns()
>may sleep there. This is the same problem commit 2ec2aff3c8e2 ("ns: make
>sure reference are dropped outside of rcu lock") fixed for the put_user()
>path. Neither ns_requested() nor may_list_ns() needs a reference, both
>only look at the namespace type and at the caller's own namespaces, so do
>the checks first and take the reference last.
>

Great catch!

>Fixes: 76b6f5dfb3fd ("nstree: add listns()")
>Signed-off-by: Norbert Szetei <norbert@xxxxxxxxxxxx>
>---
>A reproducer is available on request.

Please? Or a splat, or anything?


>
> kernel/nstree.c | 10 ++--------
> 1 file changed, 2 insertions(+), 8 deletions(-)
>
>diff --git a/kernel/nstree.c b/kernel/nstree.c
>index 6d12e5900ac0..831f279d174a 100644
>--- a/kernel/nstree.c
>+++ b/kernel/nstree.c
>@@ -533,19 +533,13 @@ DEFINE_FREE(ns_put, struct ns_common *, if (!IS_ERR_OR_NULL(_T)) ns_put(_T))
> static inline struct ns_common *__must_check legitimize_ns(const struct
> klistns *kls,
> 							   struct ns_common *candidate)
> {
>-	struct ns_common *ns __free(ns_put) = NULL;
>-
> 	if (!ns_requested(kls, candidate))
> 		return NULL;
> 
>-	ns = ns_get_unless_inactive(candidate);
>-	if (!ns)
>-		return NULL;
>-
>-	if (!may_list_ns(kls, ns))
>+	if (!may_list_ns(kls, candidate))
> 		return NULL;
> 
>-	return no_free_ptr(ns);
>+	return ns_get_unless_inactive(candidate);
> }

Fix LGTM, 

+ CC akpm, he tends to look at fixes in kernel/, if brauner wants to merge this then that's ok :)

> 
> static ssize_t do_listns_userns(struct klistns *kls)
>

--- Thanks!
https://lore.kernel.org/all/EE579805-42F2-4C58-B752-F28779EEB717@xxxxxxxxx/