[PATCH v2] cgroup: prevent css_set UAF after namespace publication

[PATCH v2] cgroup: prevent css_set UAF after namespace publication

[Jérémy Jean]

copy_cgroup_ns() sets the root of a new cgroup namespace to the parent's
css_set. When the child is created in a different cgroup,
cgroup_post_fork() replaces that root with the child's css_set after the
namespace is visible.

Publishing the namespace before root_cset is final lets readers race with
cgroup_post_fork(). A reader can load the old root just before it is
replaced and its reference is dropped, then continue using the freed
css_set. KASAN reports:

  BUG: KASAN: slab-use-after-free in kernfs_get.part.0+0x47/0x60
  Write of size 4 at addr ff1100000379f320 by task ns-path-probe/69
   kernfs_walk_and_get_ns+0x1cc/0x280
   cgroup_get_from_path+0xfb/0x340
   nft_socket_cgroup_subtree_level+0x14/0x1a0

Finalize root_cset before adding the namespace to the tree. Allocate the
namespace ID at creation, add unshared namespaces after creation succeeds,
and only remove namespaces that were added.

Fixes: ef2c41cf38a7 ("clone3: allow spawning processes into cgroups")
Assisted-by: LLM
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
---
Changes in v2:
- Finalize root_cset before publication.
- Defer tree insertion on fork.
- Handle unshare and failed forks.

v1: https://lore.kernel.org/all/20260923204935.2253203-2-Jeremy.Jean@oss.cyber.gouv.fr/

 kernel/cgroup/cgroup.c    | 22 +++++++++++++---------
 kernel/cgroup/namespace.c |  5 +++--
 kernel/nsproxy.c          |  5 +++++
 3 files changed, 21 insertions(+), 11 deletions(-)

diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 227d09704ca5..78f6d235c19b 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -7009,6 +7009,19 @@ int cgroup_can_fork(struct task_struct *child, struct kernel_clone_args *kargs)
 			goto out_revert;
 	} while_each_subsys_mask();
 
+	/* Publish a new cgroup namespace only after its root is final. */
+	if (kargs->flags & CLONE_NEWCGROUP) {
+		struct cgroup_namespace *ns = child->nsproxy->cgroup_ns;
+		struct css_set *rcset = ns->root_cset;
+
+		if (rcset != kargs->cset) {
+			get_css_set(kargs->cset);
+			ns->root_cset = kargs->cset;
+			put_css_set(rcset);
+		}
+		ns_tree_add_raw(ns);
+	}
+
 	return 0;
 
 out_revert:
@@ -7127,15 +7140,6 @@ void cgroup_post_fork(struct task_struct *child,
 		ss->fork(child);
 	} while_each_subsys_mask();
 
-	/* Make the new cset the root_cset of the new cgroup namespace. */
-	if (kargs->flags & CLONE_NEWCGROUP) {
-		struct css_set *rcset = child->nsproxy->cgroup_ns->root_cset;
-
-		get_css_set(cset);
-		child->nsproxy->cgroup_ns->root_cset = cset;
-		put_css_set(rcset);
-	}
-
 	/* Cgroup has to be killed so take down child immediately. */
 	if (unlikely(kill))
 		do_send_sig_info(SIGKILL, SEND_SIG_NOINFO, child, PIDTYPE_TGID);
diff --git a/kernel/cgroup/namespace.c b/kernel/cgroup/namespace.c
index ea4ee13936be..6c8ac36231d9 100644
--- a/kernel/cgroup/namespace.c
+++ b/kernel/cgroup/namespace.c
@@ -30,12 +30,14 @@ static struct cgroup_namespace *alloc_cgroup_ns(void)
 	ret = ns_common_init(new_ns);
 	if (ret)
 		return ERR_PTR(ret);
+	ns_tree_gen_id(new_ns);
 	return no_free_ptr(new_ns);
 }
 
 void free_cgroup_ns(struct cgroup_namespace *ns)
 {
-	ns_tree_remove(ns);
+	if (ns_tree_active(ns))
+		ns_tree_remove(ns);
 	put_css_set(ns->root_cset);
 	dec_cgroup_namespaces(ns->ucounts);
 	put_user_ns(ns->user_ns);
@@ -85,7 +87,6 @@ struct cgroup_namespace *copy_cgroup_ns(u64 flags,
 	new_ns->ucounts = ucounts;
 	new_ns->root_cset = cset;
 
-	ns_tree_add(new_ns);
 	return new_ns;
 }
 
diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c
index d9d3d5973bf5..01c4dcf26993 100644
--- a/kernel/nsproxy.c
+++ b/kernel/nsproxy.c
@@ -238,6 +238,11 @@ int unshare_nsproxy_namespaces(unsigned long unshare_flags,
 		goto out;
 	}
 
+#ifdef CONFIG_CGROUPS
+	if (flags & CLONE_NEWCGROUP)
+		ns_tree_add_raw((*new_nsp)->cgroup_ns);
+#endif
+
 out:
 	return err;
 }
-- 
2.47.3

Re: [PATCH v2] cgroup: prevent css_set UAF after namespace publication

[Tejun Heo]

Hello, Jeremy.

On Thu, Sep 24, 2026 at 11:10:37AM +0000, Jeremy Jean wrote:
> copy_cgroup_ns() sets the root of a new cgroup namespace to the parent's
> css_set. When the child is created in a different cgroup,
> cgroup_post_fork() replaces that root with the child's css_set after the
> namespace is visible.

Looks good to me.

Acked-by: Tejun Heo <tj@kernel.org>

Can you repost with the namespace maintainers cc'd (Christian Brauner and
the NAMESPACES entry in MAINTAINERS)? I'd like their acks too.

Thanks.

--
tejun

Re: [PATCH v2] cgroup: prevent css_set UAF after namespace publication

[Bradley Morgan]

On 24 September 2026 12:10:37 BST, "Jérémy Jean"
<Jeremy.Jean@oss.cyber.gouv.fr> wrote:
>copy_cgroup_ns() sets the root of a new cgroup namespace to the parent's
>css_set. When the child is created in a different cgroup,
>cgroup_post_fork() replaces that root with the child's css_set after the
>namespace is visible.
>
>Publishing the namespace before root_cset is final lets readers race with
>cgroup_post_fork(). A reader can load the old root just before it is
>replaced and its reference is dropped, then continue using the freed
>css_set. KASAN reports:
>
>  BUG: KASAN: slab-use-after-free in kernfs_get.part.0+0x47/0x60
>  Write of size 4 at addr ff1100000379f320 by task ns-path-probe/69
>   kernfs_walk_and_get_ns+0x1cc/0x280
>   cgroup_get_from_path+0xfb/0x340
>   nft_socket_cgroup_subtree_level+0x14/0x1a0
>
>Finalize root_cset before adding the namespace to the tree. Allocate the
>namespace ID at creation, add unshared namespaces after creation succeeds,
>and only remove namespaces that were added.
>
>Fixes: ef2c41cf38a7 ("clone3: allow spawning processes into cgroups")
>Assisted-by: LLM

Nice! Thanks

Reviewed-by: Bradley Morgan <brads@mainlining.org>


>Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
>---
>Changes in v2:
>- Finalize root_cset before publication.
>- Defer tree insertion on fork.
>- Handle unshare and failed forks.
>
>v1: https://lore.kernel.org/all/20260923204935.2253203-2-Jeremy.Jean@oss.cyber.gouv.fr/
>
> kernel/cgroup/cgroup.c    | 22 +++++++++++++---------
> kernel/cgroup/namespace.c |  5 +++--
> kernel/nsproxy.c          |  5 +++++
> 3 files changed, 21 insertions(+), 11 deletions(-)
>
>diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
>index 227d09704ca5..78f6d235c19b 100644
>--- a/kernel/cgroup/cgroup.c
>+++ b/kernel/cgroup/cgroup.c
>@@ -7009,6 +7009,19 @@ int cgroup_can_fork(struct task_struct *child, struct kernel_clone_args *kargs)
> 			goto out_revert;
> 	} while_each_subsys_mask();
> 
>+	/* Publish a new cgroup namespace only after its root is final. */
>+	if (kargs->flags & CLONE_NEWCGROUP) {
>+		struct cgroup_namespace *ns = child->nsproxy->cgroup_ns;
>+		struct css_set *rcset = ns->root_cset;
>+
>+		if (rcset != kargs->cset) {
>+			get_css_set(kargs->cset);
>+			ns->root_cset = kargs->cset;
>+			put_css_set(rcset);
>+		}
>+		ns_tree_add_raw(ns);
>+	}
>+
> 	return 0;
> 
> out_revert:
>@@ -7127,15 +7140,6 @@ void cgroup_post_fork(struct task_struct *child,
> 		ss->fork(child);
> 	} while_each_subsys_mask();
> 
>-	/* Make the new cset the root_cset of the new cgroup namespace. */
>-	if (kargs->flags & CLONE_NEWCGROUP) {
>-		struct css_set *rcset = child->nsproxy->cgroup_ns->root_cset;
>-
>-		get_css_set(cset);
>-		child->nsproxy->cgroup_ns->root_cset = cset;
>-		put_css_set(rcset);
>-	}
>-
> 	/* Cgroup has to be killed so take down child immediately. */
> 	if (unlikely(kill))
> 		do_send_sig_info(SIGKILL, SEND_SIG_NOINFO, child, PIDTYPE_TGID);
>diff --git a/kernel/cgroup/namespace.c b/kernel/cgroup/namespace.c
>index ea4ee13936be..6c8ac36231d9 100644
>--- a/kernel/cgroup/namespace.c
>+++ b/kernel/cgroup/namespace.c
>@@ -30,12 +30,14 @@ static struct cgroup_namespace *alloc_cgroup_ns(void)
> 	ret = ns_common_init(new_ns);
> 	if (ret)
> 		return ERR_PTR(ret);
>+	ns_tree_gen_id(new_ns);
> 	return no_free_ptr(new_ns);
> }
> 
> void free_cgroup_ns(struct cgroup_namespace *ns)
> {
>-	ns_tree_remove(ns);
>+	if (ns_tree_active(ns))
>+		ns_tree_remove(ns);
> 	put_css_set(ns->root_cset);
> 	dec_cgroup_namespaces(ns->ucounts);
> 	put_user_ns(ns->user_ns);
>@@ -85,7 +87,6 @@ struct cgroup_namespace *copy_cgroup_ns(u64 flags,
> 	new_ns->ucounts = ucounts;
> 	new_ns->root_cset = cset;
> 
>-	ns_tree_add(new_ns);
> 	return new_ns;
> }
> 
>diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c
>index d9d3d5973bf5..01c4dcf26993 100644
>--- a/kernel/nsproxy.c
>+++ b/kernel/nsproxy.c
>@@ -238,6 +238,11 @@ int unshare_nsproxy_namespaces(unsigned long unshare_flags,
> 		goto out;
> 	}
> 
>+#ifdef CONFIG_CGROUPS
>+	if (flags & CLONE_NEWCGROUP)
>+		ns_tree_add_raw((*new_nsp)->cgroup_ns);
>+#endif
>+
> out:
> 	return err;
> }
>


--- Thanks!
"I'm not a very positive person" - Linus torvalds

[PATCH v2] cgroup: prevent css_set UAF after namespace publication

[Jérémy Jean]

copy_cgroup_ns() sets the root of a new cgroup namespace to the parent's
css_set. When the child is created in a different cgroup,
cgroup_post_fork() replaces that root with the child's css_set after the
namespace is visible.

Publishing the namespace before root_cset is final lets readers race with
cgroup_post_fork(). A reader can load the old root just before it is
replaced and its reference is dropped, then continue using the freed
css_set. KASAN reports:

  BUG: KASAN: slab-use-after-free in kernfs_get.part.0+0x47/0x60
  Write of size 4 at addr ff1100000379f320 by task ns-path-probe/69
   kernfs_walk_and_get_ns+0x1cc/0x280
   cgroup_get_from_path+0xfb/0x340
   nft_socket_cgroup_subtree_level+0x14/0x1a0

Finalize root_cset before adding the namespace to the tree. Allocate the
namespace ID at creation, add unshared namespaces after creation succeeds,
and only remove namespaces that were added.

Fixes: ef2c41cf38a7 ("clone3: allow spawning processes into cgroups")
Assisted-by: LLM
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
---
Reposting v2 with NAMESPACES in Cc, as requested by Tejun Heo.

Changes in v2:
- Finalize root_cset before publication.
- Defer tree insertion on fork.
- Handle unshare and failed forks.

v1: https://lore.kernel.org/all/20260923204935.2253203-2-Jeremy.Jean@oss.cyber.gouv.fr/

 kernel/cgroup/cgroup.c    | 22 +++++++++++++---------
 kernel/cgroup/namespace.c |  5 +++--
 kernel/nsproxy.c          |  5 +++++
 3 files changed, 21 insertions(+), 11 deletions(-)

diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 227d09704ca5..78f6d235c19b 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -7009,6 +7009,19 @@ int cgroup_can_fork(struct task_struct *child, struct kernel_clone_args *kargs)
 			goto out_revert;
 	} while_each_subsys_mask();
 
+	/* Publish a new cgroup namespace only after its root is final. */
+	if (kargs->flags & CLONE_NEWCGROUP) {
+		struct cgroup_namespace *ns = child->nsproxy->cgroup_ns;
+		struct css_set *rcset = ns->root_cset;
+
+		if (rcset != kargs->cset) {
+			get_css_set(kargs->cset);
+			ns->root_cset = kargs->cset;
+			put_css_set(rcset);
+		}
+		ns_tree_add_raw(ns);
+	}
+
 	return 0;
 
 out_revert:
@@ -7127,15 +7140,6 @@ void cgroup_post_fork(struct task_struct *child,
 		ss->fork(child);
 	} while_each_subsys_mask();
 
-	/* Make the new cset the root_cset of the new cgroup namespace. */
-	if (kargs->flags & CLONE_NEWCGROUP) {
-		struct css_set *rcset = child->nsproxy->cgroup_ns->root_cset;
-
-		get_css_set(cset);
-		child->nsproxy->cgroup_ns->root_cset = cset;
-		put_css_set(rcset);
-	}
-
 	/* Cgroup has to be killed so take down child immediately. */
 	if (unlikely(kill))
 		do_send_sig_info(SIGKILL, SEND_SIG_NOINFO, child, PIDTYPE_TGID);
diff --git a/kernel/cgroup/namespace.c b/kernel/cgroup/namespace.c
index ea4ee13936be..6c8ac36231d9 100644
--- a/kernel/cgroup/namespace.c
+++ b/kernel/cgroup/namespace.c
@@ -30,12 +30,14 @@ static struct cgroup_namespace *alloc_cgroup_ns(void)
 	ret = ns_common_init(new_ns);
 	if (ret)
 		return ERR_PTR(ret);
+	ns_tree_gen_id(new_ns);
 	return no_free_ptr(new_ns);
 }
 
 void free_cgroup_ns(struct cgroup_namespace *ns)
 {
-	ns_tree_remove(ns);
+	if (ns_tree_active(ns))
+		ns_tree_remove(ns);
 	put_css_set(ns->root_cset);
 	dec_cgroup_namespaces(ns->ucounts);
 	put_user_ns(ns->user_ns);
@@ -85,7 +87,6 @@ struct cgroup_namespace *copy_cgroup_ns(u64 flags,
 	new_ns->ucounts = ucounts;
 	new_ns->root_cset = cset;
 
-	ns_tree_add(new_ns);
 	return new_ns;
 }
 
diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c
index d9d3d5973bf5..01c4dcf26993 100644
--- a/kernel/nsproxy.c
+++ b/kernel/nsproxy.c
@@ -238,6 +238,11 @@ int unshare_nsproxy_namespaces(unsigned long unshare_flags,
 		goto out;
 	}
 
+#ifdef CONFIG_CGROUPS
+	if (flags & CLONE_NEWCGROUP)
+		ns_tree_add_raw((*new_nsp)->cgroup_ns);
+#endif
+
 out:
 	return err;
 }
-- 
2.47.3

Re: [PATCH v2] cgroup: prevent css_set UAF after namespace publication

[Bradley Morgan]

On 24 September 2026 22:01:03 BST, "Jérémy Jean"
<Jeremy.Jean@oss.cyber.gouv.fr> wrote:
>copy_cgroup_ns() sets the root of a new cgroup namespace to the parent's
>css_set. When the child is created in a different cgroup,
>cgroup_post_fork() replaces that root with the child's css_set after the
>namespace is visible.
>
>Publishing the namespace before root_cset is final lets readers race with
>cgroup_post_fork(). A reader can load the old root just before it is
>replaced and its reference is dropped, then continue using the freed
>css_set. KASAN reports:
>
>  BUG: KASAN: slab-use-after-free in kernfs_get.part.0+0x47/0x60
>  Write of size 4 at addr ff1100000379f320 by task ns-path-probe/69
>   kernfs_walk_and_get_ns+0x1cc/0x280
>   cgroup_get_from_path+0xfb/0x340
>   nft_socket_cgroup_subtree_level+0x14/0x1a0
>
>Finalize root_cset before adding the namespace to the tree. Allocate the
>namespace ID at creation, add unshared namespaces after creation succeeds,
>and only remove namespaces that were added.
>
>Fixes: ef2c41cf38a7 ("clone3: allow spawning processes into cgroups")
>Assisted-by: LLM

You could have added Tejuns A-B and my R-B, but the merger can do that

>Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
>---
>Reposting v2 with NAMESPACES in Cc, as requested by Tejun Heo.
>
>Changes in v2:
>- Finalize root_cset before publication.
>- Defer tree insertion on fork.
>- Handle unshare and failed forks.
>
>v1: https://lore.kernel.org/all/20260923204935.2253203-2-Jeremy.Jean@oss.cyber.gouv.fr/
>
> kernel/cgroup/cgroup.c    | 22 +++++++++++++---------
> kernel/cgroup/namespace.c |  5 +++--
> kernel/nsproxy.c          |  5 +++++
> 3 files changed, 21 insertions(+), 11 deletions(-)
>
>diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
>index 227d09704ca5..78f6d235c19b 100644
>--- a/kernel/cgroup/cgroup.c
>+++ b/kernel/cgroup/cgroup.c
>@@ -7009,6 +7009,19 @@ int cgroup_can_fork(struct task_struct *child, struct kernel_clone_args *kargs)
> 			goto out_revert;
> 	} while_each_subsys_mask();
> 
>+	/* Publish a new cgroup namespace only after its root is final. */
>+	if (kargs->flags & CLONE_NEWCGROUP) {
>+		struct cgroup_namespace *ns = child->nsproxy->cgroup_ns;
>+		struct css_set *rcset = ns->root_cset;
>+
>+		if (rcset != kargs->cset) {
>+			get_css_set(kargs->cset);
>+			ns->root_cset = kargs->cset;
>+			put_css_set(rcset);
>+		}
>+		ns_tree_add_raw(ns);
>+	}
>+
> 	return 0;
> 
> out_revert:
>@@ -7127,15 +7140,6 @@ void cgroup_post_fork(struct task_struct *child,
> 		ss->fork(child);
> 	} while_each_subsys_mask();
> 
>-	/* Make the new cset the root_cset of the new cgroup namespace. */
>-	if (kargs->flags & CLONE_NEWCGROUP) {
>-		struct css_set *rcset = child->nsproxy->cgroup_ns->root_cset;
>-
>-		get_css_set(cset);
>-		child->nsproxy->cgroup_ns->root_cset = cset;
>-		put_css_set(rcset);
>-	}
>-
> 	/* Cgroup has to be killed so take down child immediately. */
> 	if (unlikely(kill))
> 		do_send_sig_info(SIGKILL, SEND_SIG_NOINFO, child, PIDTYPE_TGID);
>diff --git a/kernel/cgroup/namespace.c b/kernel/cgroup/namespace.c
>index ea4ee13936be..6c8ac36231d9 100644
>--- a/kernel/cgroup/namespace.c
>+++ b/kernel/cgroup/namespace.c
>@@ -30,12 +30,14 @@ static struct cgroup_namespace *alloc_cgroup_ns(void)
> 	ret = ns_common_init(new_ns);
> 	if (ret)
> 		return ERR_PTR(ret);
>+	ns_tree_gen_id(new_ns);
> 	return no_free_ptr(new_ns);
> }
> 
> void free_cgroup_ns(struct cgroup_namespace *ns)
> {
>-	ns_tree_remove(ns);
>+	if (ns_tree_active(ns))
>+		ns_tree_remove(ns);
> 	put_css_set(ns->root_cset);
> 	dec_cgroup_namespaces(ns->ucounts);
> 	put_user_ns(ns->user_ns);
>@@ -85,7 +87,6 @@ struct cgroup_namespace *copy_cgroup_ns(u64 flags,
> 	new_ns->ucounts = ucounts;
> 	new_ns->root_cset = cset;
> 
>-	ns_tree_add(new_ns);
> 	return new_ns;
> }
> 
>diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c
>index d9d3d5973bf5..01c4dcf26993 100644
>--- a/kernel/nsproxy.c
>+++ b/kernel/nsproxy.c
>@@ -238,6 +238,11 @@ int unshare_nsproxy_namespaces(unsigned long unshare_flags,
> 		goto out;
> 	}
> 
>+#ifdef CONFIG_CGROUPS
>+	if (flags & CLONE_NEWCGROUP)
>+		ns_tree_add_raw((*new_nsp)->cgroup_ns);
>+#endif
>+
> out:
> 	return err;
> }
>

--- Thanks!
"I'm not a very positive person" - Linus torvalds