Re: [PATCH] nstree: check listing permission before taking a namespace reference

[Christian Brauner]

On Sun, Sep 06, 2026 at 07:26:30PM +0100, Bradley Morgan wrote:
> On 6 September 2026 19:25:22 BST, Norbert Szetei <norbert@xxxxxxxxxxxx>
> wrote:
> >On Sep 6, 2026, at 13:52, Bradley Morgan <brads@xxxxxxxxxxxxxx> wrote:
> >> 
> >> On 4 September 2026 15:28:05 BST, Norbert Szetei <norbert@xxxxxxxxxxxx>
> >> wrote:
> >>> legitimize_ns() takes a reference on the candidate namespace before
> >>> may_list_ns() has decided whether the caller may see it. The
> >>> __free(ns_put) cleanup on the denied path can drop the last reference
> >to a
> >>> mount namespace while we still hold the rcu read lock, and put_mnt_ns()
> >>> may sleep there. This is the same problem commit 2ec2aff3c8e2 ("ns:
> >make
> >>> sure reference are dropped outside of rcu lock") fixed for the
> >put_user()
> >>> path. Neither ns_requested() nor may_list_ns() needs a reference, both
> >>> only look at the namespace type and at the caller's own namespaces, so
> >do
> >>> the checks first and take the reference last.
> >>> 
> >> 
> >> Great catch!
> >> 
> >>> Fixes: 76b6f5dfb3fd ("nstree: add listns()")
> >>> Signed-off-by: Norbert Szetei <norbert@xxxxxxxxxxxx>
> >>> ---
> >>> A reproducer is available on request.
> >> 
> >> Please? Or a splat, or anything?
> >
> >Sure, both reproducer and splat below.

The repro is available under the patch link in the commit. So no need to
dump all of this in there.