From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-00082601.pphosted.com (mx0b-00082601.pphosted.com [67.231.153.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 08857430B93 for ; Sun, 1 Mar 2026 10:46:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=67.231.153.30 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772361978; cv=none; b=htxj6Qh4oi7x8sEWCgnz4nHG0gWU4lAoD3lWkuQbAFXs9m48WsFTw0zg1gl19J3yBMJY7zNRINVFitUFjqjgWkjkJazClVyXQKRG0/r+i6P0zJj7aVnjaibOnTHyQCIAMFnlC+fp4ZvtX831W5rVi9DAFA2FyjEf5++ZsL1vB6g= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772361978; c=relaxed/simple; bh=lALEA9htqFO/i6wyM0dtEammT6At6sop4fXctkyZCfA=; h=From:To:CC:Subject:Date:Message-ID:MIME-Version:Content-Type; b=UJpZVx4qTHnRBj79NbvGEkfWqNfghc16uQS61IMt1m7HVWmh9rQBvmrTG1leKcVM46MHBs613+upIRkW5SGPx3hPPLyn+gQH3kSUmB/iE+2ioaoqa7Ts8xUVn8KBW+qc4GBJdaOtXNCIk1jcZ8Boc69rNXz0/6ocfph6gGfEujQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=meta.com; spf=pass smtp.mailfrom=meta.com; dkim=pass (2048-bit key) header.d=meta.com header.i=@meta.com header.b=AwCLdG4W; arc=none smtp.client-ip=67.231.153.30 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=meta.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=meta.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=meta.com header.i=@meta.com header.b="AwCLdG4W" Received: from pps.filterd (m0089730.ppops.net [127.0.0.1]) by m0089730.ppops.net (8.18.1.11/8.18.1.11) with ESMTP id 6218Biui3310324 for ; Sun, 1 Mar 2026 02:46:16 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=meta.com; h=cc :content-transfer-encoding:content-type:date:from:message-id :mime-version:subject:to; s=s2048-2025-q2; bh=SqItF16K4DAZ8ZtOct /9kdHl+PzeH+aHU6K3On0peSc=; b=AwCLdG4Wxfa9+S9B9K9wmiruvIXMBb78A9 IcYl7UhYZXBhCM4TSxOCIJnXE1KFw4TsE7psRekPC/OfJgpJNH09bJpVXg5HbqnC nUccDK4SHqTfraJfpalTZk8PavrbVWVEvcFPnuL4XzWI0GB0bsIe1FafcFvI3PzE IZPES0Hm6Yd6lmyHp3lVmw4vxvH/UqoN5E6EZuRi/D2YhwfeqMrjRp+DT0RfwrQy lsVBDbtSsoc+wsLftT83qaIkSze1UvT6uDoRVJotV3em2MFvgOXxS+6uLAAODs+4 0WX8iK9C2JlhPVgJMmhH7Z++QH7s44z0hfHreoNEzv4hrNMiLh4A== Received: from maileast.thefacebook.com ([163.114.135.16]) by m0089730.ppops.net (PPS) with ESMTPS id 4ckvqpp1kd-4 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT) for ; Sun, 01 Mar 2026 02:46:15 -0800 (PST) Received: from twshared4931.33.frc3.facebook.com (2620:10d:c0a8:fe::f072) by mail.thefacebook.com (2620:10d:c0a9:6f::8fd4) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.2.2562.35; Sun, 1 Mar 2026 10:46:14 +0000 Received: by devvm36217.lla0.facebook.com (Postfix, from userid 240176) id 5514AEC8F62B; Sun, 1 Mar 2026 02:46:00 -0800 (PST) From: Michal Grzedzicki To: CC: , , , , , , Subject: [PATCH 1/1] nsproxy: fix credential leak in prepare_nsset() on copy_fs_struct() failure Date: Sun, 1 Mar 2026 02:45:46 -0800 Message-ID: <20260301104546.618068-1-mge@meta.com> X-Mailer: git-send-email 2.47.3 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-FB-Internal: Safe Content-Type: text/plain X-Proofpoint-ORIG-GUID: qW7ckuBlFn79GjtKOtZyCDjHCFb0F5P1 X-Authority-Analysis: v=2.4 cv=XL49iAhE c=1 sm=1 tr=0 ts=69a418f7 cx=c_pps a=MfjaFnPeirRr97d5FC5oHw==:117 a=MfjaFnPeirRr97d5FC5oHw==:17 a=Yq5XynenixoA:10 a=VkNPw1HP01LnGYTKEx00:22 a=7x6HtfJdh03M6CCDgxCd:22 a=855S8uPTkML1Oy45N9_h:22 a=VabnemYjAAAA:8 a=i52ZinW55HjbG_MIJ10A:9 a=gKebqoRLp9LExxC7YDUY:22 X-Proofpoint-GUID: qW7ckuBlFn79GjtKOtZyCDjHCFb0F5P1 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwMzAxMDA5NiBTYWx0ZWRfX/4J/iqCs5vNx Xh70GV2OBzFCaGpMTS7+KCpKs4PnXfLHFjiAfXKf9LSqj7bM0+7p1KdHe6Om2gKePJ2dbgcmBW6 V5+JzF+hX7VyCCTf0paUHR1HoeG2VgLuBLgrhxiH519o7BxrXSP+HwkgeGQBXWKoXpEcQgQdNPb YNXR9EV0AXSOrirzfF06SDoyOtYb1L7Sxa7e0+XcwuhdnDH7I7PgiN7awJ27o16Q05s6L7WxOWV oVOR8D8tgslZZVpf9THvGEto+HgRXMb+0l2GSbUMrtayBoyXlHAES0APUZLm6pejXauW3waHjaT oeXhb7b846YdXtcCojihUJVSQOl6TagaH90whNZKjDhJkXvJXC19CWpAaMzgDL7itNNWymTGBVR d+BCMDsx94dJiFAOQnGiA5KIjL/dAa4kchK9+Y+rV0FXz9sfFHkGkbRXQqCqEYDc5lT5thbsBPH lnRgQNvebDhDnF6Uf5A== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1121,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-03-01_01,2026-02-27_03,2025-10-01_01 nsset->flags is only set on the success path, so when copy_fs_struct() fails put_nsset() sees flags =3D=3D 0 and skips put_cred() for the credential allocated by prepare_creds(). Set nsset->flags before copy_fs_struct() so put_nsset() performs correct cleanup. This is safe because put_nsset() already checks nsset->fs and nsset->nsproxy for NULL independently. Fixes: f2a8d52e0a4d ("nsproxy: add struct nsset") Signed-off-by: Michal Grzedzicki --- kernel/nsproxy.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c index 259c4b4f1eeb..39ec77a2acc2 100644 --- a/kernel/nsproxy.c +++ b/kernel/nsproxy.c @@ -353,6 +353,9 @@ static int prepare_nsset(unsigned flags, struct nsset= *nsset) if (IS_ERR(nsset->nsproxy)) return PTR_ERR(nsset->nsproxy); =20 + /* Set flags early so put_nsset() can clean up properly on failure. */ + nsset->flags =3D flags; + if (flags & CLONE_NEWUSER) nsset->cred =3D prepare_creds(); else @@ -368,8 +371,6 @@ static int prepare_nsset(unsigned flags, struct nsset= *nsset) if (!nsset->fs) goto out; } - - nsset->flags =3D flags; return 0; =20 out: --=20 2.47.3