unshare: fix nsproxy leak on set_cred_ucounts() error path
Subsystems (4)
Andrew Morton
maintainerPATCH 1/1 unshare: fix nsproxy leak on set_cred_ucounts() error path
From: Pavel Tikhomirov <[email protected]>
Subject: unshare: fix nsproxy leak on set_cred_ucounts() error path
Date: Tue, 18 Nov 2025 14:45:50 +0800
If unshare_nsproxy_namespaces() successfully creates the new_nsproxy, but then set_cred_ucounts() fails, on its error path there is no cleanup for new_nsproxy, so it is leaked. Let's fix that by freeing new_nsproxy if it's not NULL on this error path.
Fixes 905ae01c4ae2a ("Add a reference to ucounts for each cred")
Signed-off-by Pavel Tikhomirov <[email protected]>
Acked-by Alexey Gladkov <[email protected]>
Reviewed-by Liam R. Howlett <[email protected]>
Cc Ben Segall <[email protected]>
Cc Dietmar Eggemann <[email protected]>
Cc Eric Biederman <[email protected]>
Cc Ingo Molnar <[email protected]>
Cc Juri Lelli <[email protected]>
Cc Kees Cook <[email protected]>
Cc Lorenzo Stoakes <[email protected]>
Cc Mel Gorman <mgorman <[email protected]>
Cc Michal Hocko <[email protected]>
Cc Mike Rapoport <[email protected]>
Cc Peter Zijlstra <[email protected]>
Cc Steven Rostedt <[email protected]>
Cc Suren Baghdasaryan <[email protected]>
Cc Valentin Schneider <[email protected]>
Cc Vincent Guittot <[email protected]>
Cc Vlastimil Babka <[email protected]>
Cc <[email protected]>
Signed-off-by Andrew Morton <[email protected]>
---
kernel/fork.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
kernel/fork.c renamed from kernel/fork.c~unshare-fix-nsproxy-leak-on-set_cred_ucounts-error-path +4 -1
@@ -3133,8 +3133,11 @@ int ksys_unshare(unsigned long unshare_fif (new_cred) { err =set_cred_ucounts (new_cred); -if (err) +if (err) { +if (new_nsproxy) +free_nsproxy (new_nsproxy); goto bad_unshare_cleanup_cred; + } }if (new_fs || new_fd || do_sysvsem || new_cred || new_nsproxy) {
_