[PATCH] fork: fix active reference underflow on unshare() failure

[PATCH] fork: fix active reference underflow on unshare() failure

[Tao Cui]

From: Tao Cui <cuitao@kylinos.cn>

When set_cred_ucounts() fails in ksys_unshare() the new nsproxy is
released with put_nsproxy().  But the nsproxy has not been installed
at this point; it is only marked as active once
switch_task_namespaces() installs it, which happens after all failure
points.  Dropping the last reference therefore deactivates it and
puts the active reference of every namespace it points to: for
namespaces created by this unshare() call the active count underflows
to -1, and for namespaces carried over from the caller a live active
reference of the still-running task is dropped, which makes them
disappear from nsfs file handles and listns and causes a cascading
underflow at task exit.

Use nsproxy_free() on this error path, which drops the regular
references without touching the active ones, like the setns() failure
paths already do; see commit cefd55bd2159 ("nsproxy: fix
free_nsproxy() and simplify create_new_namespaces()").

Fixes: a98621a0f187a ("unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure")
Link: https://lore.kernel.org/r/20251118064552.936962-1-ptikhomirov@virtuozzo.com
Link: https://lore.kernel.org/r/20260213193959.2556730-1-mge@meta.com
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
---
 include/linux/nsproxy.h | 1 +
 kernel/fork.c           | 2 +-
 kernel/nsproxy.c        | 2 +-
 3 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/include/linux/nsproxy.h b/include/linux/nsproxy.h
index 5a67648721c7d..dc2447f5f0924 100644
--- a/include/linux/nsproxy.h
+++ b/include/linux/nsproxy.h
@@ -100,6 +100,7 @@ void exit_cred_namespaces(struct task_struct *tsk);
 void switch_task_namespaces(struct task_struct *tsk, struct nsproxy *new);
 int exec_task_namespaces(void);
 void deactivate_nsproxy(struct nsproxy *ns);
+void nsproxy_free(struct nsproxy *ns);
 int unshare_nsproxy_namespaces(unsigned long, struct nsproxy **,
 	struct cred *, struct fs_struct *);
 int __init nsproxy_cache_init(void);
diff --git a/kernel/fork.c b/kernel/fork.c
index d458d85d7a656..11e16554daa61 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -3324,7 +3324,7 @@ int ksys_unshare(unsigned long unshare_flags)
 
 bad_unshare_cleanup_nsproxy:
 	if (new_nsproxy)
-		put_nsproxy(new_nsproxy);
+		nsproxy_free(new_nsproxy);
 bad_unshare_cleanup_cred:
 	if (new_cred)
 		put_cred(new_cred);
diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c
index 0f1b208d8eeff..454427b09ed97 100644
--- a/kernel/nsproxy.c
+++ b/kernel/nsproxy.c
@@ -61,7 +61,7 @@ static inline struct nsproxy *create_nsproxy(void)
 	return nsproxy;
 }
 
-static inline void nsproxy_free(struct nsproxy *ns)
+void nsproxy_free(struct nsproxy *ns)
 {
 	put_mnt_ns(ns->mnt_ns);
 	put_uts_ns(ns->uts_ns);
-- 
2.43.0

Re: [PATCH] fork: fix active reference underflow on unshare() failure

[Bradley Morgan]

On 27 September 2026 10:54:50 BST, Tao Cui <cui.tao@linux.dev> wrote:
>From: Tao Cui <cuitao@kylinos.cn>
>
>When set_cred_ucounts() fails in ksys_unshare() the new nsproxy is
>released with put_nsproxy().  But the nsproxy has not been installed
>at this point; it is only marked as active once
>switch_task_namespaces() installs it, which happens after all failure
>points.  Dropping the last reference therefore deactivates it and
>puts the active reference of every namespace it points to: for
>namespaces created by this unshare() call the active count underflows
>to -1, and for namespaces carried over from the caller a live active
>reference of the still-running task is dropped, which makes them
>disappear from nsfs file handles and listns and causes a cascading
>underflow at task exit.
>
>Use nsproxy_free() on this error path, which drops the regular
>references without touching the active ones, like the setns() failure
>paths already do; see commit cefd55bd2159 ("nsproxy: fix
>free_nsproxy() and simplify create_new_namespaces()").
>
>Fixes: a98621a0f187a ("unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure")
>Link: https://lore.kernel.org/r/20251118064552.936962-1-ptikhomirov@virtuozzo.com
>Link: https://lore.kernel.org/r/20260213193959.2556730-1-mge@meta.com

Reviewed-by: Bradley Morgan <brads@mainlining.org>

Tested-by: Bradley Morgan <brads@mainlining.org> # Power10

Splat:

WARNING: kernel/nscommon.c:171 at __ns_ref_active_put (VFS_WARN_ON_ONCE, active < 0)
  NIP:  __ns_ref_active_put+0x11c
  LR:   nsproxy_ns_active_put+0x30
  Call Trace: deactivate_nsproxy+0x24 <- ksys_unshare+0x528
followed by a second WARNING at put_mnt_ns (ns_common.h:78)




>Signed-off-by: Tao Cui <cuitao@kylinos.cn>
>---
> include/linux/nsproxy.h | 1 +
> kernel/fork.c           | 2 +-
> kernel/nsproxy.c        | 2 +-
> 3 files changed, 3 insertions(+), 2 deletions(-)
>
>diff --git a/include/linux/nsproxy.h b/include/linux/nsproxy.h
>index 5a67648721c7d..dc2447f5f0924 100644
>--- a/include/linux/nsproxy.h
>+++ b/include/linux/nsproxy.h
>@@ -100,6 +100,7 @@ void exit_cred_namespaces(struct task_struct *tsk);
> void switch_task_namespaces(struct task_struct *tsk, struct nsproxy
> *new);
> int exec_task_namespaces(void);
> void deactivate_nsproxy(struct nsproxy *ns);
>+void nsproxy_free(struct nsproxy *ns);
> int unshare_nsproxy_namespaces(unsigned long, struct nsproxy **,
> 	struct cred *, struct fs_struct *);
> int __init nsproxy_cache_init(void);
>diff --git a/kernel/fork.c b/kernel/fork.c
>index d458d85d7a656..11e16554daa61 100644
>--- a/kernel/fork.c
>+++ b/kernel/fork.c
>@@ -3324,7 +3324,7 @@ int ksys_unshare(unsigned long unshare_flags)
> 
> bad_unshare_cleanup_nsproxy:
> 	if (new_nsproxy)
>-		put_nsproxy(new_nsproxy);
>+		nsproxy_free(new_nsproxy);
> bad_unshare_cleanup_cred:
> 	if (new_cred)
> 		put_cred(new_cred);
>diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c
>index 0f1b208d8eeff..454427b09ed97 100644
>--- a/kernel/nsproxy.c
>+++ b/kernel/nsproxy.c
>@@ -61,7 +61,7 @@ static inline struct nsproxy *create_nsproxy(void)
> 	return nsproxy;
> }
> 
>-static inline void nsproxy_free(struct nsproxy *ns)
>+void nsproxy_free(struct nsproxy *ns)
> {
> 	put_mnt_ns(ns->mnt_ns);
> 	put_uts_ns(ns->uts_ns);
>

--- Thanks!
"I'm not a very positive person" - Linus torvalds

Re: [PATCH] fork: fix active reference underflow on unshare() failure

[Pavel Tikhomirov]

On 9/27/26 11:54, Tao Cui wrote:
> From: Tao Cui <cuitao@kylinos.cn>
> 
> When set_cred_ucounts() fails in ksys_unshare() the new nsproxy is
> released with put_nsproxy().  But the nsproxy has not been installed
> at this point; it is only marked as active once
> switch_task_namespaces() installs it, which happens after all failure
> points.  Dropping the last reference therefore deactivates it and
> puts the active reference of every namespace it points to: for
> namespaces created by this unshare() call the active count underflows
> to -1, and for namespaces carried over from the caller a live active
> reference of the still-running task is dropped, which makes them
> disappear from nsfs file handles and listns and causes a cascading
> underflow at task exit.
> 
> Use nsproxy_free() on this error path, which drops the regular
> references without touching the active ones, like the setns() failure
> paths already do; see commit cefd55bd2159 ("nsproxy: fix
> free_nsproxy() and simplify create_new_namespaces()").
> 
> Fixes: a98621a0f187a ("unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure")
> Link: https://lore.kernel.org/r/20251118064552.936962-1-ptikhomirov@virtuozzo.com
> Link: https://lore.kernel.org/r/20260213193959.2556730-1-mge@meta.com

Reviewed-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>

> Signed-off-by: Tao Cui <cuitao@kylinos.cn>
> ---
>  include/linux/nsproxy.h | 1 +
>  kernel/fork.c           | 2 +-
>  kernel/nsproxy.c        | 2 +-
>  3 files changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/include/linux/nsproxy.h b/include/linux/nsproxy.h
> index 5a67648721c7d..dc2447f5f0924 100644
> --- a/include/linux/nsproxy.h
> +++ b/include/linux/nsproxy.h
> @@ -100,6 +100,7 @@ void exit_cred_namespaces(struct task_struct *tsk);
>  void switch_task_namespaces(struct task_struct *tsk, struct nsproxy *new);
>  int exec_task_namespaces(void);
>  void deactivate_nsproxy(struct nsproxy *ns);
> +void nsproxy_free(struct nsproxy *ns);
>  int unshare_nsproxy_namespaces(unsigned long, struct nsproxy **,
>  	struct cred *, struct fs_struct *);
>  int __init nsproxy_cache_init(void);
> diff --git a/kernel/fork.c b/kernel/fork.c
> index d458d85d7a656..11e16554daa61 100644
> --- a/kernel/fork.c
> +++ b/kernel/fork.c
> @@ -3324,7 +3324,7 @@ int ksys_unshare(unsigned long unshare_flags)
>  
>  bad_unshare_cleanup_nsproxy:
>  	if (new_nsproxy)
> -		put_nsproxy(new_nsproxy);
> +		nsproxy_free(new_nsproxy);
>  bad_unshare_cleanup_cred:
>  	if (new_cred)
>  		put_cred(new_cred);
> diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c
> index 0f1b208d8eeff..454427b09ed97 100644
> --- a/kernel/nsproxy.c
> +++ b/kernel/nsproxy.c
> @@ -61,7 +61,7 @@ static inline struct nsproxy *create_nsproxy(void)
>  	return nsproxy;
>  }
>  
> -static inline void nsproxy_free(struct nsproxy *ns)
> +void nsproxy_free(struct nsproxy *ns)
>  {
>  	put_mnt_ns(ns->mnt_ns);
>  	put_uts_ns(ns->uts_ns);

-- 
Best regards, Pavel Tikhomirov
Senior Software Developer, Virtuozzo.