From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 28E86347514; Wed, 20 May 2026 18:37:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779302276; cv=none; b=IEc3IK2/lVZwy6IUAyGye0xk10dikj1Y4BlOMaJ0kKl+EmBZpxUEf7DKYq9mMyugmNDrAr0MhKG0dnmoqAvdGDZBcE1xxmBA/AS0WOxKfKcm6Pb9d3TpYzefzLU2lNJtL0lB5Lk7cRWA5Z19vqItZRdVpHKFTI5H1IEk0Pan5bE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779302276; c=relaxed/simple; bh=F/jrPL8O5o/rAN0d/j6LhA2GB9fBxS/uv445VTV2UOc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=BsnJJGKw0MWGWrGewIho5t4g9NEx3KxAZ5vWjsBoKmaKRQgnsKO4gqWazQQb2q3U+BkIMq7yGjV3aYPLQrC6l0NdCuvuvV5ONuRwyMl7IAZ1bLQkAD0dPQg6gWkYEoT8Q8Zv64fR1XDEyXevlnGCz5b/kpoa8KydM5+f2vG5/Ro= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=tWTWsvet; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="tWTWsvet" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6420E1F000E9; Wed, 20 May 2026 18:37:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1779302275; bh=V8y6E0zQs10/o56Z/Ejql+Ys+jzkVg7boPtfUfU3c8s=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=tWTWsvetQGPcjZQYCVhK0Ztpig/VBNG1nOMpvsYBbOxsT+uo2Nk3xNLCXVb6U9ZSH 1+z0qsFJbtFywOKGb9F+gvjYDDWwoyGzVJn0wuojPhgJAYuXfK/mAQZG7jcfZauFYn hc0Iv4uIzWfdWh+kDTB0ZcZmyMGPbs4SWr0qhcVQ= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Michal Grzedzicki , Andrew Morton , "Alexey Gladkov (Intel)" , Ben Segall , David Hildenbrand , Dietmar Eggemann , Ingo Molnar , Juri Lelli , Kees Cook , "Liam R. Howlett" , "Lorenzo Stoakes (Oracle)" , Mel Gorman , Michal Hocko , Mike Rapoport , Peter Zijlstra , Steven Rostedt , Suren Baghdasaryan , Valentin Schneider , Vincent Guittot , Vlastimil Babka , Sasha Levin Subject: [PATCH 6.6 204/508] unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure Date: Wed, 20 May 2026 18:20:27 +0200 Message-ID: <20260520162103.057407333@linuxfoundation.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260520162058.573354582@linuxfoundation.org> References: <20260520162058.573354582@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Michal Grzedzicki [ Upstream commit a98621a0f187a934c115dcfe79a49520ae892111 ] When set_cred_ucounts() fails in ksys_unshare() new_nsproxy is leaked. Let's call put_nsproxy() if that happens. Link: https://lkml.kernel.org/r/20260213193959.2556730-1-mge@meta.com Fixes: 905ae01c4ae2 ("Add a reference to ucounts for each cred") Signed-off-by: Michal Grzedzicki Reviewed-by: Andrew Morton Cc: Alexey Gladkov (Intel) Cc: Ben Segall Cc: David Hildenbrand Cc: Dietmar Eggemann Cc: Ingo Molnar Cc: Juri Lelli Cc: Kees Cook Cc: "Liam R. Howlett" Cc: Lorenzo Stoakes (Oracle) Cc: Mel Gorman Cc: Michal Hocko Cc: Mike Rapoport Cc: Peter Zijlstra Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Valentin Schneider Cc: Vincent Guittot Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Sasha Levin --- kernel/fork.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/kernel/fork.c b/kernel/fork.c index c65a70581af73..e280f02b6446a 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -3443,11 +3443,10 @@ int ksys_unshare(unsigned long unshare_flags) new_cred, new_fs); if (err) goto bad_unshare_cleanup_cred; - if (new_cred) { err = set_cred_ucounts(new_cred); if (err) - goto bad_unshare_cleanup_cred; + goto bad_unshare_cleanup_nsproxy; } if (new_fs || new_fd || do_sysvsem || new_cred || new_nsproxy) { @@ -3463,8 +3462,10 @@ int ksys_unshare(unsigned long unshare_flags) shm_init_task(current); } - if (new_nsproxy) + if (new_nsproxy) { switch_task_namespaces(current, new_nsproxy); + new_nsproxy = NULL; + } task_lock(current); @@ -3493,13 +3494,15 @@ int ksys_unshare(unsigned long unshare_flags) perf_event_namespaces(current); +bad_unshare_cleanup_nsproxy: + if (new_nsproxy) + put_nsproxy(new_nsproxy); bad_unshare_cleanup_cred: if (new_cred) put_cred(new_cred); bad_unshare_cleanup_fd: if (new_fd) put_files_struct(new_fd); - bad_unshare_cleanup_fs: if (new_fs) free_fs_struct(new_fs); -- 2.53.0