linux-kernel - Forwarded: [PATCH] ns: skip active reference management on initial namespaces

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <690dd51c.a70a0220.22f260.003f.GAE@google.com>
Date: Fri, 07 Nov 2025 03:16:44 -0800
From: syzbot <syzbot+0b2e79f91ff6579bfa5b@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Forwarded: [PATCH] ns: skip active reference management on initial namespaces

For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com.

***

Subject: [PATCH] ns: skip active reference management on initial namespaces
Author: kartikey406@...il.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master

Initial namespaces (init_net, init_uts_ns, init_pid_ns, etc.) are
statically allocated and exist for the entire lifetime of the system.
They should not participate in active reference counting.

Currently, when operations like setns() or process creation involve
initial namespaces, active references are being taken and dropped on
them. This causes the active reference count to become imbalanced,
leading to warnings when the count goes negative or hits zero.

Fix by modifying the ns_ref_active_put macro to check if the namespace
is an initial namespace before dropping the active reference. This
ensures initial namespaces are completely excluded from active
reference management at all call sites.

Reported-by: syzbot+0b2e79f91ff6579bfa5b@...kaller.appspotmail.com
Signed-off-by: Deepanshu Kartikey <kartikey406@...il.com>
---
 include/linux/ns_common.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/ns_common.h b/include/linux/ns_common.h
index bd4492ef6ffc..6353120e60be 100644
--- a/include/linux/ns_common.h
+++ b/include/linux/ns_common.h
@@ -314,7 +314,7 @@ static __always_inline void __ns_ref_active_put(struct ns_common *ns)
 	}
 }
 #define ns_ref_active_put(__ns) \
-	do { if (__ns) __ns_ref_active_put(to_ns_common(__ns)); } while (0)
+	do { if ((__ns) &&  !is_initial_namespace(&(__ns)->ns)) __ns_ref_active_put(to_ns_common(__ns)); } while (0)

 static __always_inline struct ns_common *__must_check ns_get_unless_inactive(struct ns_common *ns)
 {
-- 
2.43.0