Re: [PATCH] fork: fix active reference underflow on unshare() failure

[Bradley Morgan]

On 27 September 2026 10:54:50 BST, Tao Cui <cui.tao@xxxxxxxxx> wrote:
>From: Tao Cui <cuitao@xxxxxxxxxx>
>
>When set_cred_ucounts() fails in ksys_unshare() the new nsproxy is
>released with put_nsproxy().  But the nsproxy has not been installed
>at this point; it is only marked as active once
>switch_task_namespaces() installs it, which happens after all failure
>points.  Dropping the last reference therefore deactivates it and
>puts the active reference of every namespace it points to: for
>namespaces created by this unshare() call the active count underflows
>to -1, and for namespaces carried over from the caller a live active
>reference of the still-running task is dropped, which makes them
>disappear from nsfs file handles and listns and causes a cascading
>underflow at task exit.
>
>Use nsproxy_free() on this error path, which drops the regular
>references without touching the active ones, like the setns() failure
>paths already do; see commit cefd55bd2159 ("nsproxy: fix
>free_nsproxy() and simplify create_new_namespaces()").
>
>Fixes: a98621a0f187a ("unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure")
>Link: https://lore.kernel.org/r/20251118064552.936962-1-ptikhomirov@xxxxxxxxxxxxx
>Link: https://lore.kernel.org/r/20260213193959.2556730-1-mge@xxxxxxxx

Reviewed-by: Bradley Morgan <brads@xxxxxxxxxxxxxx>

Tested-by: Bradley Morgan <brads@xxxxxxxxxxxxxx> # Power10

Splat:

WARNING: kernel/nscommon.c:171 at __ns_ref_active_put (VFS_WARN_ON_ONCE, active < 0)
  NIP:  __ns_ref_active_put+0x11c
  LR:   nsproxy_ns_active_put+0x30
  Call Trace: deactivate_nsproxy+0x24 <- ksys_unshare+0x528
followed by a second WARNING at put_mnt_ns (ns_common.h:78)




>Signed-off-by: Tao Cui <cuitao@xxxxxxxxxx>
>---
> include/linux/nsproxy.h | 1 +
> kernel/fork.c           | 2 +-
> kernel/nsproxy.c        | 2 +-
> 3 files changed, 3 insertions(+), 2 deletions(-)
>
>diff --git a/include/linux/nsproxy.h b/include/linux/nsproxy.h
>index 5a67648721c7d..dc2447f5f0924 100644
>--- a/include/linux/nsproxy.h
>+++ b/include/linux/nsproxy.h
>@@ -100,6 +100,7 @@ void exit_cred_namespaces(struct task_struct *tsk);
> void switch_task_namespaces(struct task_struct *tsk, struct nsproxy
> *new);
> int exec_task_namespaces(void);
> void deactivate_nsproxy(struct nsproxy *ns);
>+void nsproxy_free(struct nsproxy *ns);
> int unshare_nsproxy_namespaces(unsigned long, struct nsproxy **,
> 	struct cred *, struct fs_struct *);
> int __init nsproxy_cache_init(void);
>diff --git a/kernel/fork.c b/kernel/fork.c
>index d458d85d7a656..11e16554daa61 100644
>--- a/kernel/fork.c
>+++ b/kernel/fork.c
>@@ -3324,7 +3324,7 @@ int ksys_unshare(unsigned long unshare_flags)
> 
> bad_unshare_cleanup_nsproxy:
> 	if (new_nsproxy)
>-		put_nsproxy(new_nsproxy);
>+		nsproxy_free(new_nsproxy);
> bad_unshare_cleanup_cred:
> 	if (new_cred)
> 		put_cred(new_cred);
>diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c
>index 0f1b208d8eeff..454427b09ed97 100644
>--- a/kernel/nsproxy.c
>+++ b/kernel/nsproxy.c
>@@ -61,7 +61,7 @@ static inline struct nsproxy *create_nsproxy(void)
> 	return nsproxy;
> }
> 
>-static inline void nsproxy_free(struct nsproxy *ns)
>+void nsproxy_free(struct nsproxy *ns)
> {
> 	put_mnt_ns(ns->mnt_ns);
> 	put_uts_ns(ns->uts_ns);
>

--- Thanks!
"I'm not a very positive person" - Linus torvalds