Michal Grzedzicki 297261b343 unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure ...

[ Upstream commit a98621a0f1 ]

When set_cred_ucounts() fails in ksys_unshare() new_nsproxy is leaked.

Let's call put_nsproxy() if that happens.

Link: https://lkml.kernel.org/r/20260213193959.2556730-1-mge@meta.com
Fixes: 905ae01c4a ("Add a reference to ucounts for each cred")
Signed-off-by: Michal Grzedzicki <mge@meta.com>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Alexey Gladkov (Intel) <legion@kernel.org>
Cc: Ben Segall <bsegall@google.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Kees Cook <kees@kernel.org>
Cc: "Liam R. Howlett" <Liam.Howlett@oracle.com>
Cc: Lorenzo Stoakes (Oracle) <ljs@kernel.org>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Valentin Schneider <vschneid@redhat.com>
Cc: Vincent Guittot <vincent.guittot@linaro.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2026-06-01 17:39:15 +02:00

..

bpf

bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks

2026-06-01 17:39:07 +02:00

cgroup

cgroup: fix race between task migration and iteration

2026-03-25 11:03:06 +01:00

configs

…

debug

kdb: Do not assume write() callback available

2025-02-21 13:50:09 +01:00

dma

dma: swiotlb: add KMSAN annotations to swiotlb_bounce()

2026-04-11 14:16:05 +02:00

entry

entry: Respect changes to system call number by trace_sys_enter()

2024-04-03 15:19:44 +02:00

events

x86/uprobes: Fix XOL allocation failure for 32-bit tasks

2026-03-25 11:03:19 +01:00

futex

futex: Clear stale exiting pointer in futex_lock_pi() retry path

2026-04-11 14:16:18 +02:00

gcov

gcov: add support for GCC 15

2025-12-07 06:12:35 +09:00

irq

genirq/irq_sim: Initialize work context pointers properly

2026-02-06 16:44:22 +01:00

kcsan

kcsan: test: Initialize dummy variable

2025-08-15 12:04:59 +02:00

livepatch

livepatch: Match old_sympos 0 and 1 in klp_find_func()

2026-01-11 15:18:40 +01:00

locking

rtmutex: Use waiter::task instead of current in remove_waiter()

2026-06-01 17:38:51 +02:00

module

module: Fix freeing of charp module parameters when CONFIG_SYSFS=n

2026-06-01 17:39:06 +02:00

power

PM: sleep: console: Fix the black screen issue

2025-08-28 16:25:53 +02:00

printk

printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX

2025-02-21 13:49:30 +01:00

rcu

rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access

2026-03-25 11:03:24 +01:00

sched

sched/fair: Fix pelt clock sync when entering idle

2026-03-25 11:03:23 +01:00

time

hrtimer: Reduce trace noise in hrtimer_start()

2026-06-01 17:39:05 +02:00

trace

tracing/probe: reject non-closed empty immediate strings

2026-06-01 17:38:34 +02:00

.gitignore

…

acct.c

acct: block access to kernel internal filesystems

2025-03-07 16:56:39 +01:00

async.c

async: Introduce async_schedule_dev_nocall()

2024-01-31 16:17:00 -08:00

audit_fsnotify.c

…

audit_tree.c

…

audit_watch.c

…

audit.c

audit: Send netlink ACK before setting connection in auditd_set

2024-02-05 20:12:47 +00:00

audit.h

audit: avoid missing-prototype warnings

2026-03-04 07:19:20 -05:00

auditfilter.c

ima: Avoid blocking in RCU read-side critical section

2024-07-11 12:47:16 +02:00

auditsc.c

…

backtracetest.c

…

bounds.c

bounds: Use the right number of bits for power-of-two CONFIG_NR_CPUS

2024-05-02 16:29:32 +02:00

capability.c

…

cfi.c

…

compat.c

…

configs.c

…

context_tracking.c

…

cpu_pm.c

…

cpu.c

hrtimers: Handle CPU state correctly on hotplug

2025-01-23 17:17:15 +01:00

crash_core.c

…

crash_dump.c

…

cred.c

cred: switch to using atomic_long_t

2023-12-20 17:00:20 +01:00

delayacct.c

…

dma.c

…

exec_domain.c

…

exit.c

exit: Sleep at TASK_IDLE when waiting for application core dump

2026-06-01 17:39:00 +02:00

extable.c

…

fail_function.c

…

fork.c

unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure

2026-06-01 17:39:15 +02:00

freezer.c

…

gen_kheaders.sh

kheaders: Ignore silly-rename files

2025-01-23 17:17:11 +01:00

groups.c

…

hung_task.c

…

iomem.c

…

irq_work.c

…

jump_label.c

jump_label: Fix static_key_slow_dec() yet again

2024-10-17 15:21:29 +02:00

kallsyms_internal.h

…

kallsyms.c

kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup()

2026-03-04 07:19:40 -05:00

kcmp.c

…

Kconfig.freezer

…

Kconfig.hz

…

Kconfig.locks

…

Kconfig.preempt

…

kcov.c

kcov: mark in_softirq_really() as __always_inline

2025-01-09 13:30:05 +01:00

kexec_core.c

…

kexec_elf.c

kexec: initialize ELF lowest address to ULONG_MAX

2025-04-10 14:33:36 +02:00

kexec_file.c

kexec: derive purgatory entry from symbol

2026-03-04 07:20:50 -05:00

kexec_internal.h

…

kexec.c

…

kheaders.c

…

kmod.c

…

kprobes.c

kprobes: Remove unneeded warnings from __arm_kprobe_ftrace()

2026-03-25 11:03:16 +01:00

ksysfs.c

…

kthread.c

kthread: unpark only parked kthread

2024-10-17 15:22:28 +02:00

latencytop.c

…

Makefile

kernel/numa.c: Move logging out of numa.h

2024-06-12 11:03:16 +02:00

module_signature.c

…

notifier.c

…

nsproxy.c

…

numa.c

kernel/numa.c: Move logging out of numa.h

2024-06-12 11:03:16 +02:00

padata.c

padata: Put CPU offline callback in ONLINE section to allow failure

2026-06-01 17:39:10 +02:00

panic.c

panic: Flush kernel log buffer at the end

2024-04-13 13:04:54 +02:00

params.c

module: Fix freeing of charp module parameters when CONFIG_SYSFS=n

2026-06-01 17:39:06 +02:00

pid_namespace.c

pid: Replace struct pid 1-element array with flex-array

2024-08-29 17:30:18 +02:00

pid.c

pid: Add a judgment for ns null in pid_nr_ns

2025-10-19 16:23:22 +02:00

profile.c

profiling: remove profile=sleep support

2024-08-14 13:52:50 +02:00

ptrace.c

ptrace: slightly saner 'get_dumpable()' logic

2026-05-15 14:49:41 +02:00

range.c

…

reboot.c

…

regset.c

regset: use kvzalloc() for regset_get_alloc()

2026-06-01 17:38:44 +02:00

relay.c

…

resource_kunit.c

…

resource.c

Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()"

2026-01-11 15:18:32 +01:00

rseq.c

rseq: Protect event mask against membarrier IPI

2025-10-19 16:23:21 +02:00

scftorture.c

…

scs.c

scs: fix a wrong parameter in __scs_magic

2026-01-11 15:18:54 +01:00

seccomp.c

seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast

2025-10-15 11:56:25 +02:00

signal.c

signal: restore the override_rlimit logic

2024-11-14 13:15:18 +01:00

smp.c

smp: Fix up and expand the smp_call_function_many() kerneldoc

2025-10-15 11:56:29 +02:00

smpboot.c

…

smpboot.h

…

softirq.c

softirq: Add trace points for tasklet entry/exit

2025-12-07 06:12:34 +09:00

stackleak.c

…

stacktrace.c

…

static_call_inline.c

x86/static-call: provide a way to do very early static-call updates

2024-12-19 18:08:58 +01:00

static_call.c

…

stop_machine.c

…

sys_ni.c

syscalls: fix compat_sys_io_pgetevents_time64 usage

2024-07-05 09:31:59 +02:00

sys.c

kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths

2025-10-19 16:23:14 +02:00

sysctl-test.c

…

sysctl.c

sysctl: fix uninitialized variable in proc_do_large_bitmap

2026-04-11 14:16:12 +02:00

task_work.c

task_work: Introduce task_work_cancel() again

2024-08-03 08:49:34 +02:00

taskstats.c

taskstats: set version in TGID exit notifications

2026-06-01 17:38:50 +02:00

torture.c

…

tracepoint.c

…

tsacct.c

…

ucount.c

ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit()

2026-03-04 07:19:42 -05:00

uid16.c

…

uid16.h

…

umh.c

…

up.c

…

user_namespace.c

…

user-return-notifier.c

…

user.c

…

usermode_driver.c

…

utsname_sysctl.c

…

utsname.c

…

watch_queue.c

watch_queue: fix pipe accounting mismatch

2025-04-10 14:33:30 +02:00

watchdog_hld.c

watchdog/perf: properly initialize the turbo mode timestamp and rearm counter

2024-08-03 08:49:42 +02:00

watchdog.c

…

workqueue_internal.h

…

workqueue.c

workqueue: Improve scalability of workqueue watchdog touch

2024-09-12 11:10:27 +02:00