Re: [PATCH v2] cgroup: prevent css_set UAF after namespace publication

[Bradley Morgan <brads@mainlining.org>]

On 24 September 2026 22:01:03 BST, "Jérémy Jean"
<Jeremy.Jean@oss.cyber.gouv.fr> wrote:
>copy_cgroup_ns() sets the root of a new cgroup namespace to the parent's
>css_set. When the child is created in a different cgroup,
>cgroup_post_fork() replaces that root with the child's css_set after the
>namespace is visible.
>
>Publishing the namespace before root_cset is final lets readers race with
>cgroup_post_fork(). A reader can load the old root just before it is
>replaced and its reference is dropped, then continue using the freed
>css_set. KASAN reports:
>
>  BUG: KASAN: slab-use-after-free in kernfs_get.part.0+0x47/0x60
>  Write of size 4 at addr ff1100000379f320 by task ns-path-probe/69
>   kernfs_walk_and_get_ns+0x1cc/0x280
>   cgroup_get_from_path+0xfb/0x340
>   nft_socket_cgroup_subtree_level+0x14/0x1a0
>
>Finalize root_cset before adding the namespace to the tree. Allocate the
>namespace ID at creation, add unshared namespaces after creation succeeds,
>and only remove namespaces that were added.
>
>Fixes: ef2c41cf38a7 ("clone3: allow spawning processes into cgroups")
>Assisted-by: LLM

You could have added Tejuns A-B and my R-B, but the merger can do that

>Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
>---
>Reposting v2 with NAMESPACES in Cc, as requested by Tejun Heo.
>
>Changes in v2:
>- Finalize root_cset before publication.
>- Defer tree insertion on fork.
>- Handle unshare and failed forks.
>
>v1: https://lore.kernel.org/all/20260923204935.2253203-2-Jeremy.Jean@oss.cyber.gouv.fr/
>
> kernel/cgroup/cgroup.c    | 22 +++++++++++++---------
> kernel/cgroup/namespace.c |  5 +++--
> kernel/nsproxy.c          |  5 +++++
> 3 files changed, 21 insertions(+), 11 deletions(-)
>
>diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
>index 227d09704ca5..78f6d235c19b 100644
>--- a/kernel/cgroup/cgroup.c
>+++ b/kernel/cgroup/cgroup.c
>@@ -7009,6 +7009,19 @@ int cgroup_can_fork(struct task_struct *child, struct kernel_clone_args *kargs)
> 			goto out_revert;
> 	} while_each_subsys_mask();
> 
>+	/* Publish a new cgroup namespace only after its root is final. */
>+	if (kargs->flags & CLONE_NEWCGROUP) {
>+		struct cgroup_namespace *ns = child->nsproxy->cgroup_ns;
>+		struct css_set *rcset = ns->root_cset;
>+
>+		if (rcset != kargs->cset) {
>+			get_css_set(kargs->cset);
>+			ns->root_cset = kargs->cset;
>+			put_css_set(rcset);
>+		}
>+		ns_tree_add_raw(ns);
>+	}
>+
> 	return 0;
> 
> out_revert:
>@@ -7127,15 +7140,6 @@ void cgroup_post_fork(struct task_struct *child,
> 		ss->fork(child);
> 	} while_each_subsys_mask();
> 
>-	/* Make the new cset the root_cset of the new cgroup namespace. */
>-	if (kargs->flags & CLONE_NEWCGROUP) {
>-		struct css_set *rcset = child->nsproxy->cgroup_ns->root_cset;
>-
>-		get_css_set(cset);
>-		child->nsproxy->cgroup_ns->root_cset = cset;
>-		put_css_set(rcset);
>-	}
>-
> 	/* Cgroup has to be killed so take down child immediately. */
> 	if (unlikely(kill))
> 		do_send_sig_info(SIGKILL, SEND_SIG_NOINFO, child, PIDTYPE_TGID);
>diff --git a/kernel/cgroup/namespace.c b/kernel/cgroup/namespace.c
>index ea4ee13936be..6c8ac36231d9 100644
>--- a/kernel/cgroup/namespace.c
>+++ b/kernel/cgroup/namespace.c
>@@ -30,12 +30,14 @@ static struct cgroup_namespace *alloc_cgroup_ns(void)
> 	ret = ns_common_init(new_ns);
> 	if (ret)
> 		return ERR_PTR(ret);
>+	ns_tree_gen_id(new_ns);
> 	return no_free_ptr(new_ns);
> }
> 
> void free_cgroup_ns(struct cgroup_namespace *ns)
> {
>-	ns_tree_remove(ns);
>+	if (ns_tree_active(ns))
>+		ns_tree_remove(ns);
> 	put_css_set(ns->root_cset);
> 	dec_cgroup_namespaces(ns->ucounts);
> 	put_user_ns(ns->user_ns);
>@@ -85,7 +87,6 @@ struct cgroup_namespace *copy_cgroup_ns(u64 flags,
> 	new_ns->ucounts = ucounts;
> 	new_ns->root_cset = cset;
> 
>-	ns_tree_add(new_ns);
> 	return new_ns;
> }
> 
>diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c
>index d9d3d5973bf5..01c4dcf26993 100644
>--- a/kernel/nsproxy.c
>+++ b/kernel/nsproxy.c
>@@ -238,6 +238,11 @@ int unshare_nsproxy_namespaces(unsigned long unshare_flags,
> 		goto out;
> 	}
> 
>+#ifdef CONFIG_CGROUPS
>+	if (flags & CLONE_NEWCGROUP)
>+		ns_tree_add_raw((*new_nsp)->cgroup_ns);
>+#endif
>+
> out:
> 	return err;
> }
>

--- Thanks!
"I'm not a very positive person" - Linus torvalds