nsfs: keep namespace tree fields stable until after RCU grace period

Browse source

struct ns_common overlays struct ns_tree with the rcu_head used by kfree_rcu().
That lets the deferred-free machinery overwrite ns_id and __ns_ref_active as
soon as a namespace is queued for freeing, even though nsfs tree walkers may
still read those fields under RCU after ns_tree_remove(). KASAN reports slab
UAF.

Keep the tree state and deferred-free callback storage separate. Namespace tree
readers can then continue to validate and take references until the grace
period has elapsed.

Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Link: https://patch.msgid.link/20260814102005.1939777-1-Jeremy.Jean@oss.cyber.gouv.fr
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

...

This commit is contained in:

Jérémy Jean 2026-08-14 10:20:05 +00:00 • committed by Christian Brauner

parent 0ecd56573c

commit 82e9343260

No known key found for this signature in database

GPG key ID: 91C61BC06578DCA2

1 changed files with 2 additions and 4 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

6

include/linux/ns/ns_common_types.h

View file