Gh0st
/
linux
mirror of https://github.com/torvalds/linux.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

nsproxy: fix free_nsproxy() and simplify create_new_namespaces() 

Make it possible to handle NULL being passed to the reference count
helpers instead of forcing the caller to handle this. Afterwards we can
nicely allow a cleanup guard to handle nsproxy freeing.

Active reference count handling is not done in nsproxy_free() but rather
in free_nsproxy() as nsproxy_free() is also called from setns() failure
paths where a new nsproxy has been prepared but has not been marked as
active via switch_task_namespaces().

Link: https://lore.kernel.org/690bfb9e.050a0220.2e3c35.0013.GAE@google.com
Link: https://patch.msgid.link/20251111-sakralbau-guthaben-7dcc277d337f@brauner
Fixes: 3c9820d5c64a ("ns: add active reference count")
Reported-by: syzbot+0b2e79f91ff6579bfa5b@syzkaller.appspotmail.com
Reported-by: syzbot+0a8655a80e189278487e@syzkaller.appspotmail.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
This commit is contained in:
Christian Brauner 2025-11-11 22:29:44 +01:00
parent 18b5c40048
commit cefd55bd21
No known key found for this signature in database
GPG Key ID: 91C61BC06578DCA2
3 changed files with 29 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
include/linux/ns_common.h
View File

@ -114,11 +114,14 @@ static __always_inline __must_check bool __ns_ref_dec_and_lock(struct ns_common
} }
#define ns_ref_read(__ns) __ns_ref_read(to_ns_common((__ns))) #define ns_ref_read(__ns) __ns_ref_read(to_ns_common((__ns)))
#define ns_ref_inc(__ns) __ns_ref_inc(to_ns_common((__ns))) #define ns_ref_inc(__ns) \
#define ns_ref_get(__ns) __ns_ref_get(to_ns_common((__ns))) do { if (__ns) __ns_ref_inc(to_ns_common((__ns))); } while (0)
#define ns_ref_put(__ns) __ns_ref_put(to_ns_common((__ns))) #define ns_ref_get(__ns) \
((__ns) ? __ns_ref_get(to_ns_common((__ns))) : false)
#define ns_ref_put(__ns) \
((__ns) ? __ns_ref_put(to_ns_common((__ns))) : false)
#define ns_ref_put_and_lock(__ns, __ns_lock) \ #define ns_ref_put_and_lock(__ns, __ns_lock) \
__ns_ref_dec_and_lock(to_ns_common((__ns)), __ns_lock) ((__ns) ? __ns_ref_dec_and_lock(to_ns_common((__ns)), __ns_lock) : false)
#define ns_ref_active_read(__ns) \ #define ns_ref_active_read(__ns) \
((__ns) ? __ns_ref_active_read(to_ns_common(__ns)) : 0) ((__ns) ? __ns_ref_active_read(to_ns_common(__ns)) : 0)

4
include/linux/nsproxy.h
View File

@ -99,7 +99,7 @@ void get_cred_namespaces(struct task_struct *tsk);
void exit_cred_namespaces(struct task_struct *tsk); void exit_cred_namespaces(struct task_struct *tsk);
void switch_task_namespaces(struct task_struct *tsk, struct nsproxy *new); void switch_task_namespaces(struct task_struct *tsk, struct nsproxy *new);
int exec_task_namespaces(void); int exec_task_namespaces(void);
void free_nsproxy(struct nsproxy *ns); void deactivate_nsproxy(struct nsproxy *ns);
int unshare_nsproxy_namespaces(unsigned long, struct nsproxy **, int unshare_nsproxy_namespaces(unsigned long, struct nsproxy **,
struct cred *, struct fs_struct *); struct cred *, struct fs_struct *);
int __init nsproxy_cache_init(void); int __init nsproxy_cache_init(void);
@ -107,7 +107,7 @@ int __init nsproxy_cache_init(void);
static inline void put_nsproxy(struct nsproxy *ns) static inline void put_nsproxy(struct nsproxy *ns)
{ {
if (refcount_dec_and_test(&ns->count)) if (refcount_dec_and_test(&ns->count))
free_nsproxy(ns); deactivate_nsproxy(ns);
} }
static inline void get_nsproxy(struct nsproxy *ns) static inline void get_nsproxy(struct nsproxy *ns)

36
kernel/nsproxy.c
View File

@ -60,6 +60,25 @@ static inline struct nsproxy *create_nsproxy(void)
return nsproxy; return nsproxy;
} }
static inline void nsproxy_free(struct nsproxy *ns)
{
put_mnt_ns(ns->mnt_ns);
put_uts_ns(ns->uts_ns);
put_ipc_ns(ns->ipc_ns);
put_pid_ns(ns->pid_ns_for_children);
put_time_ns(ns->time_ns);
put_time_ns(ns->time_ns_for_children);
put_cgroup_ns(ns->cgroup_ns);
put_net(ns->net_ns);
kmem_cache_free(nsproxy_cachep, ns);
}
void deactivate_nsproxy(struct nsproxy *ns)
{
nsproxy_ns_active_put(ns);
nsproxy_free(ns);
}
/* /*
* Create new nsproxy and all of its the associated namespaces. * Create new nsproxy and all of its the associated namespaces.
* Return the newly created nsproxy. Do not attach this to the task, * Return the newly created nsproxy. Do not attach this to the task,
@ -185,21 +204,6 @@ int copy_namespaces(u64 flags, struct task_struct *tsk)
return 0; return 0;
} }
void free_nsproxy(struct nsproxy *ns)
{
nsproxy_ns_active_put(ns);
put_mnt_ns(ns->mnt_ns);
put_uts_ns(ns->uts_ns);
put_ipc_ns(ns->ipc_ns);
put_pid_ns(ns->pid_ns_for_children);
put_time_ns(ns->time_ns);
put_time_ns(ns->time_ns_for_children);
put_cgroup_ns(ns->cgroup_ns);
put_net(ns->net_ns);
kmem_cache_free(nsproxy_cachep, ns);
}
/* /*
* Called from unshare. Unshare all the namespaces part of nsproxy. * Called from unshare. Unshare all the namespaces part of nsproxy.
* On success, returns the new nsproxy. * On success, returns the new nsproxy.
@ -338,7 +342,7 @@ static void put_nsset(struct nsset *nsset)
if (nsset->fs && (flags & CLONE_NEWNS) && (flags & ~CLONE_NEWNS)) if (nsset->fs && (flags & CLONE_NEWNS) && (flags & ~CLONE_NEWNS))
free_fs_struct(nsset->fs); free_fs_struct(nsset->fs);
if (nsset->nsproxy) if (nsset->nsproxy)
free_nsproxy(nsset->nsproxy); nsproxy_free(nsset->nsproxy);
} }
static int prepare_nsset(unsigned flags, struct nsset *nsset) static int prepare_nsset(unsigned flags, struct nsset *nsset)