[PATCH] fork: fix active reference underflow on unshare() failure

[Tao Cui <cui.tao@linux.dev>]

From: Tao Cui <cuitao@kylinos.cn>

When set_cred_ucounts() fails in ksys_unshare() the new nsproxy is
released with put_nsproxy().  But the nsproxy has not been installed
at this point; it is only marked as active once
switch_task_namespaces() installs it, which happens after all failure
points.  Dropping the last reference therefore deactivates it and
puts the active reference of every namespace it points to: for
namespaces created by this unshare() call the active count underflows
to -1, and for namespaces carried over from the caller a live active
reference of the still-running task is dropped, which makes them
disappear from nsfs file handles and listns and causes a cascading
underflow at task exit.

Use nsproxy_free() on this error path, which drops the regular
references without touching the active ones, like the setns() failure
paths already do; see commit cefd55bd2159 ("nsproxy: fix
free_nsproxy() and simplify create_new_namespaces()").

Fixes: a98621a0f187a ("unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure")
Link: https://lore.kernel.org/r/20251118064552.936962-1-ptikhomirov@virtuozzo.com
Link: https://lore.kernel.org/r/20260213193959.2556730-1-mge@meta.com
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
---
 include/linux/nsproxy.h | 1 +
 kernel/fork.c           | 2 +-
 kernel/nsproxy.c        | 2 +-
 3 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/include/linux/nsproxy.h b/include/linux/nsproxy.h
index 5a67648721c7d..dc2447f5f0924 100644
--- a/include/linux/nsproxy.h
+++ b/include/linux/nsproxy.h
@@ -100,6 +100,7 @@ void exit_cred_namespaces(struct task_struct *tsk);
 void switch_task_namespaces(struct task_struct *tsk, struct nsproxy *new);
 int exec_task_namespaces(void);
 void deactivate_nsproxy(struct nsproxy *ns);
+void nsproxy_free(struct nsproxy *ns);
 int unshare_nsproxy_namespaces(unsigned long, struct nsproxy **,
 	struct cred *, struct fs_struct *);
 int __init nsproxy_cache_init(void);
diff --git a/kernel/fork.c b/kernel/fork.c
index d458d85d7a656..11e16554daa61 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -3324,7 +3324,7 @@ int ksys_unshare(unsigned long unshare_flags)
 
 bad_unshare_cleanup_nsproxy:
 	if (new_nsproxy)
-		put_nsproxy(new_nsproxy);
+		nsproxy_free(new_nsproxy);
 bad_unshare_cleanup_cred:
 	if (new_cred)
 		put_cred(new_cred);
diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c
index 0f1b208d8eeff..454427b09ed97 100644
--- a/kernel/nsproxy.c
+++ b/kernel/nsproxy.c
@@ -61,7 +61,7 @@ static inline struct nsproxy *create_nsproxy(void)
 	return nsproxy;
 }
 
-static inline void nsproxy_free(struct nsproxy *ns)
+void nsproxy_free(struct nsproxy *ns)
 {
 	put_mnt_ns(ns->mnt_ns);
 	put_uts_ns(ns->uts_ns);
-- 
2.43.0