Jérémy Jean 82e9343260 nsfs: keep namespace tree fields stable until after RCU grace period ...

struct ns_common overlays struct ns_tree with the rcu_head used by kfree_rcu().
That lets the deferred-free machinery overwrite ns_id and __ns_ref_active as
soon as a namespace is queued for freeing, even though nsfs tree walkers may
still read those fields under RCU after ns_tree_remove(). KASAN reports slab
UAF.

Keep the tree state and deferred-free callback storage separate. Namespace tree
readers can then continue to validate and take references until the grace
period has elapsed.

Signed-off-by: Jérémy Jean <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Christian Brauner (Amutable) <[email protected]>

2026-08-21 13:59:05 +02:00

..

ns_common_types.h

nsfs: keep namespace tree fields stable until after RCU grace period

2026-08-21 13:59:05 +02:00

nstree_types.h

nstree: switch to new structures

2025-11-11 10:01:30 +01:00