Re: [PATCH] nstree: check listing permission before taking a namespace reference

[Bradley Morgan <brads@mainlining.org>]

On 6 September 2026 12:52:04 BST, Bradley Morgan <brads@mainlining.org>
wrote:
>On 4 September 2026 15:28:05 BST, Norbert Szetei <norbert@doyensec.com>
>wrote:
>>legitimize_ns() takes a reference on the candidate namespace before
>>may_list_ns() has decided whether the caller may see it. The
>>__free(ns_put) cleanup on the denied path can drop the last reference to
>a
>>mount namespace while we still hold the rcu read lock, and put_mnt_ns()
>>may sleep there. This is the same problem commit 2ec2aff3c8e2 ("ns: make
>>sure reference are dropped outside of rcu lock") fixed for the put_user()
>>path. Neither ns_requested() nor may_list_ns() needs a reference, both
>>only look at the namespace type and at the caller's own namespaces, so do
>>the checks first and take the reference last.
>>
>
>Great catch!
>
>>Fixes: 76b6f5dfb3fd ("nstree: add listns()")
>>Signed-off-by: Norbert Szetei <norbert@doyensec.com>
>>---
>>A reproducer is available on request.
>
>Please? Or a splat, or anything?
>
>
>>
>> kernel/nstree.c | 10 ++--------
>> 1 file changed, 2 insertions(+), 8 deletions(-)
>>
>>diff --git a/kernel/nstree.c b/kernel/nstree.c
>>index 6d12e5900ac0..831f279d174a 100644
>>--- a/kernel/nstree.c
>>+++ b/kernel/nstree.c
>>@@ -533,19 +533,13 @@ DEFINE_FREE(ns_put, struct ns_common *, if
>(!IS_ERR_OR_NULL(_T)) ns_put(_T))
>> static inline struct ns_common *__must_check legitimize_ns(const struct
>> klistns *kls,
>> 							   struct ns_common *candidate)
>> {
>>-	struct ns_common *ns __free(ns_put) = NULL;
>>-
>> 	if (!ns_requested(kls, candidate))
>> 		return NULL;
>> 
>>-	ns = ns_get_unless_inactive(candidate);
>>-	if (!ns)
>>-		return NULL;
>>-
>>-	if (!may_list_ns(kls, ns))
>>+	if (!may_list_ns(kls, candidate))
>> 		return NULL;
>> 
>>-	return no_free_ptr(ns);
>>+	return ns_get_unless_inactive(candidate);
>> }
>
>Fix LGTM, 
>
>+ CC akpm, he tends to look at fixes in kernel/, if brauner wants to merge this then that's ok :)
>
>> 
>> static ssize_t do_listns_userns(struct klistns *kls)
>>
>
>--- Thanks!
>https://lore.kernel.org/all/EE579805-42F2-4C58-B752-F28779EEB717@grrlz.net/

Forgot my tag, oops!

Reviewed-by: Bradley Morgan <brads@mainlining.org>

--- Thanks!
https://lore.kernel.org/all/EE579805-42F2-4C58-B752-F28779EEB717@grrlz.net/