Jérémy Jean 82e9343260 nsfs: keep namespace tree fields stable until after RCU grace period ... struct ns_common overlays struct ns_tree with the rcu_head used by kfree_rcu(). That lets the deferred-free machinery overwrite ns_id and __ns_ref_active as soon as a namespace is queued for freeing, even though nsfs tree walkers may still read those fields under RCU after ns_tree_remove(). KASAN reports slab UAF. Keep the tree state and deferred-free callback storage separate. Namespace tree readers can then continue to validate and take references until the grace period has elapsed. Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr> Link: https://patch.msgid.link/20260814102005.1939777-1-Jeremy.Jean@oss.cyber.gouv.fr Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>		2026-08-21 13:59:05 +02:00
..
ns_common_types.h	nsfs: keep namespace tree fields stable until after RCU grace period	2026-08-21 13:59:05 +02:00
nstree_types.h	nstree: switch to new structures	2025-11-11 10:01:30 +01:00