github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-11 20:13:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

nsfs: keep namespace tree fields stable until after RCU grace period

Browse Source 
struct ns_common overlays struct ns_tree with the rcu_head used by kfree_rcu().
That lets the deferred-free machinery overwrite ns_id and __ns_ref_active as
soon as a namespace is queued for freeing, even though nsfs tree walkers may
still read those fields under RCU after ns_tree_remove(). KASAN reports slab
UAF.

Keep the tree state and deferred-free callback storage separate. Namespace tree
readers can then continue to validate and take references until the grace
period has elapsed.

Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Link: https://patch.msgid.link/20260814102005.1939777-1-Jeremy.Jean@oss.cyber.gouv.fr
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
This commit is contained in:
Jérémy Jean 2026-08-14 10:20:05 +00:00 committed by Christian Brauner
parent 0ecd56573c
commit 82e9343260
No known key found for this signature in database
GPG Key ID: 91C61BC06578DCA2
1 changed files with 2 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
include/linux/ns/ns_common_types.h
View File

@ -116,10 +116,8 @@ struct ns_common {
struct dentry *stashed;
const struct proc_ns_operations *ops;
unsigned int inum;
union {
struct ns_tree;
struct rcu_head ns_rcu;
};
struct ns_tree;
struct rcu_head ns_rcu;
};
#define to_ns_common(__ns) \