From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A78023EAC82; Wed, 20 May 2026 18:14:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779300891; cv=none; b=jNPvrwjF7aFr+fqawvmy/kK++CnYVB+rwpkAvMarbFNPI9+T8vsFHwqwHPJjK8DOiC8GpkAUALpABvvm50azo5UQF+BJq6/rttvEYBnuuKa1NzMavkY2k7D/CBm03UKFdZocv0+fwWrhnwuR8px4/CCfeKu2IsZpUW+2taL89XE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779300891; c=relaxed/simple; bh=UO4HBjaRzRF83C+l6Ehwn6p2G06IYbvbx4ydyw4ciAw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=eA0x6wQphOpQ24l8bBx5zSN/t/dp1x4izJqRs4LkWpN+23Q6wRCE+Xd/U2KzFkcovHPEH0btDXTfGrn3KiPbNT7wB1vGFaOXGVJiqJkmN2AlNdZJaVzt+4+fjxw/HznSYW4NOKkpaj/Rg1+kn0QUypiAhoFr4HFti/WmIA8+zOc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=IeR9gkii; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="IeR9gkii" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B2A071F000E9; Wed, 20 May 2026 18:14:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1779300890; bh=vx3qJtWiWSYMRlrbtNi+jpgQ5lDyao/FJ6/mSaQNvV0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=IeR9gkiiwMqA+LW4AZu85nnL6/Iid2Hj+Li7DdyGBJrm0sZ+LJkVf9LJriN/FyzxG lRyjdXsDDpwoupUrw46KE/GqxVjw/0QetdnXDIiTyhMY3fWVq3fZS7ZoaWPDr9Fp6k K7i4D5i0iMnA8yH4ya+fPNp4QKDPZBZW8hqRefTE= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Michal Grzedzicki , Andrew Morton , "Alexey Gladkov (Intel)" , Ben Segall , David Hildenbrand , Dietmar Eggemann , Ingo Molnar , Juri Lelli , Kees Cook , "Liam R. Howlett" , "Lorenzo Stoakes (Oracle)" , Mel Gorman , Michal Hocko , Mike Rapoport , Peter Zijlstra , Steven Rostedt , Suren Baghdasaryan , Valentin Schneider , Vincent Guittot , Vlastimil Babka , Sasha Levin Subject: [PATCH 6.12 306/666] unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure Date: Wed, 20 May 2026 18:18:37 +0200 Message-ID: <20260520162117.853261730@linuxfoundation.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260520162111.222830634@linuxfoundation.org> References: <20260520162111.222830634@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Michal Grzedzicki [ Upstream commit a98621a0f187a934c115dcfe79a49520ae892111 ] When set_cred_ucounts() fails in ksys_unshare() new_nsproxy is leaked. Let's call put_nsproxy() if that happens. Link: https://lkml.kernel.org/r/20260213193959.2556730-1-mge@meta.com Fixes: 905ae01c4ae2 ("Add a reference to ucounts for each cred") Signed-off-by: Michal Grzedzicki Reviewed-by: Andrew Morton Cc: Alexey Gladkov (Intel) Cc: Ben Segall Cc: David Hildenbrand Cc: Dietmar Eggemann Cc: Ingo Molnar Cc: Juri Lelli Cc: Kees Cook Cc: "Liam R. Howlett" Cc: Lorenzo Stoakes (Oracle) Cc: Mel Gorman Cc: Michal Hocko Cc: Mike Rapoport Cc: Peter Zijlstra Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Valentin Schneider Cc: Vincent Guittot Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Sasha Levin --- kernel/fork.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/kernel/fork.c b/kernel/fork.c index c6415bb0abf59..c4955cffcb6f4 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -3348,11 +3348,10 @@ int ksys_unshare(unsigned long unshare_flags) new_cred, new_fs); if (err) goto bad_unshare_cleanup_cred; - if (new_cred) { err = set_cred_ucounts(new_cred); if (err) - goto bad_unshare_cleanup_cred; + goto bad_unshare_cleanup_nsproxy; } if (new_fs || new_fd || do_sysvsem || new_cred || new_nsproxy) { @@ -3368,8 +3367,10 @@ int ksys_unshare(unsigned long unshare_flags) shm_init_task(current); } - if (new_nsproxy) + if (new_nsproxy) { switch_task_namespaces(current, new_nsproxy); + new_nsproxy = NULL; + } task_lock(current); @@ -3398,13 +3399,15 @@ int ksys_unshare(unsigned long unshare_flags) perf_event_namespaces(current); +bad_unshare_cleanup_nsproxy: + if (new_nsproxy) + put_nsproxy(new_nsproxy); bad_unshare_cleanup_cred: if (new_cred) put_cred(new_cred); bad_unshare_cleanup_fd: if (new_fd) put_files_struct(new_fd); - bad_unshare_cleanup_fs: if (new_fs) free_fs_struct(new_fs); -- 2.53.0