From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-00082601.pphosted.com (mx0a-00082601.pphosted.com [67.231.145.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8000C213E89 for ; Fri, 13 Feb 2026 19:40:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=67.231.145.42 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771011627; cv=none; b=h5tN9rjPmFHrKMYoGLfbnJOSBkyUfz8LDUJ9A/g5P7/KP2FfG9jGCdLgQ2r6EvIluGrhx7CRCEKQB8cV5DKhg83yoQ4lRAmUBEGy5zYINLCz+NNtJhB+pKnQhQPeeQOMN6savcKF9ecJ+ivCcsPMJH/Q1WvldjyENLzRps4Gs9U= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771011627; c=relaxed/simple; bh=D3en57oj/qFyQHUp25Zei5VDZMoSllz5Af2YYfak/6I=; h=From:To:CC:Subject:Date:Message-ID:MIME-Version:Content-Type; b=luSWjrEvsMxDT6PczzqwWMoE3y4ARb0zy2BFck2b/DmFO74Sq6RuBysvJjQxxWCFrgIAEBopu4zTyWDhw7mB8FVHLx4TOO2QP67qnUIkmQuYfZg0O3/zrpXrSoxEwfO9ZnCKuGr/XCo19rkRYxR9S2aA91J5IWUFXVX13Dfm9dE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=meta.com; spf=pass smtp.mailfrom=meta.com; dkim=pass (2048-bit key) header.d=meta.com header.i=@meta.com header.b=RvuYmT5H; arc=none smtp.client-ip=67.231.145.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=meta.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=meta.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=meta.com header.i=@meta.com header.b="RvuYmT5H" Received: from pps.filterd (m0109334.ppops.net [127.0.0.1]) by mx0a-00082601.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 61DFOda5321314 for ; Fri, 13 Feb 2026 11:40:24 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=meta.com; h=cc :content-transfer-encoding:content-type:date:from:message-id :mime-version:subject:to; s=s2048-2025-q2; bh=QMnCZbxRB5uCbUsX61 S7QUxAwg6rwB3l35sIiChLFp4=; b=RvuYmT5H35Nzdhz0lIGGkwNnI0s5bUnWXe ZZm/uDPEfkOn143ZRiEF1zWJErlLYjBI8Jzeo1gmn2+85ltYKEx2jMDhA8qzxgIm CQX7y0JURvg7n/H5b3uKy+hRFIJswvbWAK/hr7OD1eZJ0QPHMmvFKZ71nHEum0vs fXRZZvxcha9GKt9mhR3BQ5d794ZkG71BQOkhjzZ75rrDf2xjkdvcY1HV+DgzBbs2 5L43eqbFr5pC4x5cxSCLmI+sDCX2JbGNg747xZsNCRxsCqXnKh+WBevoToCXwOHD ulTqoGO24WFkU3T9ZVGkYFNt3EdbwPnYlWwCERK7CCSL+dbHE0Zg== Received: from maileast.thefacebook.com ([163.114.135.16]) by mx0a-00082601.pphosted.com (PPS) with ESMTPS id 4ca6ju3g4s-4 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT) for ; Fri, 13 Feb 2026 11:40:24 -0800 (PST) Received: from twshared13080.31.frc3.facebook.com (2620:10d:c0a8:1c::11) by mail.thefacebook.com (2620:10d:c0a9:6f::237c) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.2.2562.35; Fri, 13 Feb 2026 19:40:22 +0000 Received: by devvm36217.lla0.facebook.com (Postfix, from userid 240176) id B1FF6A03F386; Fri, 13 Feb 2026 11:40:16 -0800 (PST) From: Michal Grzedzicki To: CC: , , , , , , Subject: [PATCH 1/1] unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure Date: Fri, 13 Feb 2026 11:39:59 -0800 Message-ID: <20260213193959.2556730-1-mge@meta.com> X-Mailer: git-send-email 2.47.3 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-FB-Internal: Safe Content-Type: text/plain X-Proofpoint-GUID: jm38jWVRkfQjAUeo8h_ghF56KHhWkGQ9 X-Authority-Analysis: v=2.4 cv=PZ3yRyhd c=1 sm=1 tr=0 ts=698f7e28 cx=c_pps a=MfjaFnPeirRr97d5FC5oHw==:117 a=MfjaFnPeirRr97d5FC5oHw==:17 a=HzLeVaNsDn8A:10 a=VkNPw1HP01LnGYTKEx00:22 a=Mpw57Om8IfrbqaoTuvik:22 a=GgsMoib0sEa3-_RKJdDe:22 a=VabnemYjAAAA:8 a=AEBfEOGD2oHt8OWDrbYA:9 a=gKebqoRLp9LExxC7YDUY:22 X-Proofpoint-ORIG-GUID: jm38jWVRkfQjAUeo8h_ghF56KHhWkGQ9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwMjEzMDE1MSBTYWx0ZWRfX9BnCCozSqldf 3LvnH2FcsiB0IH2hIREhNb60y0jOGTuHvhzGaquFr/KpSbmiA10xpux/mhty5kPLWKvee0Vxwm+ 33Lld9Mtmr6tE3KpLRhew4ek6zl+jUQPJwskg+cdyIr1QkWnSN9N6JSnBvNMji8LX8+WfLEB5D9 eiq3UqA/Wnl46iqqZoJzOFGLPeRESIipsSlypsbU36F8vqnp0SzVnXl+0+G1AjEBrPuqs8tRtM7 UbNFXs9kcO0Q8rvjTLwG8dN5tmgAa2W6/SGqO1Zo3+Loo1s8DlItk7LEGcj21SPBPaapkHZxWH+ ylLz9tFacUVqMhyUY+L8ZJHpmaAEr2ifMJm9r00yijaFY13zowOWJClquZrh2fOCidD4q5mpL71 CcaEgtYKm2MRDfjnnZfXBMBSRIv93PIzRBp0FYvbyGCzLHW9skC2ZEdHpCVtnV25E32sXf9Evql hS4/gy23dVCa7lKq0sA== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1121,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-02-13_04,2026-02-13_01,2025-10-01_01 When set_cred_ucounts() fails in ksys_unshare() new_nsproxy is leaked. Let's call put_nsproxy() if that happens. Fixes: 905ae01c4ae2 ("Add a reference to ucounts for each cred") Signed-off-by: Michal Grzedzicki --- kernel/fork.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/kernel/fork.c b/kernel/fork.c index e832da9d15a4..f6a5ed2067b7 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -3175,11 +3175,10 @@ int ksys_unshare(unsigned long unshare_flags) new_cred, new_fs); if (err) goto bad_unshare_cleanup_cred; - if (new_cred) { err =3D set_cred_ucounts(new_cred); if (err) - goto bad_unshare_cleanup_cred; + goto bad_unshare_cleanup_nsproxy; } =20 if (new_fs || new_fd || do_sysvsem || new_cred || new_nsproxy) { @@ -3195,8 +3194,10 @@ int ksys_unshare(unsigned long unshare_flags) shm_init_task(current); } =20 - if (new_nsproxy) + if (new_nsproxy) { switch_task_namespaces(current, new_nsproxy); + new_nsproxy =3D NULL; + } =20 task_lock(current); =20 @@ -3225,13 +3226,15 @@ int ksys_unshare(unsigned long unshare_flags) =20 perf_event_namespaces(current); =20 +bad_unshare_cleanup_nsproxy: + if (new_nsproxy) + put_nsproxy(new_nsproxy); bad_unshare_cleanup_cred: if (new_cred) put_cred(new_cred); bad_unshare_cleanup_fd: if (new_fd) put_files_struct(new_fd); - bad_unshare_cleanup_fs: if (new_fs) free_fs_struct(new_fs); --=20 2.47.3