From b64a9f67e082e04835ddd69d422a25168d69375b Mon Sep 17 00:00:00 2001 From: =?utf8?q?J=C3=A9r=C3=A9my=20Jean?= Date: Tue, 11 Aug 2026 19:10:11 +0000 Subject: [PATCH] pid: reject allocations through dead ancestor pid namespaces MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit alloc_pid() checks PIDNS_ADDING only on the leaf pid namespace before making a new struct pid visible in every ancestor namespace. That is insufficient when an unborn descendant pid namespace outlives an ancestor whose init task has already exited. The descendant can still be initialized later through setns(), and the new pid is then published into the dead ancestor as well. Keep the existing ENOMEM behavior, but require PIDNS_ADDING to be set in every namespace that will receive the new pid before publishing any of them. This preserves the invariant that free_pid() never decrements pid_allocated in a namespace whose child_reaper is no longer live. Fixes: a3bdc23ba8ea ("pid_namespace: allow opening pid_for_children before init was created") Signed-off-by: Jérémy Jean Reviewed-by: Pavel Tikhomirov Signed-off-by: Christian Brauner (Amutable) --- kernel/pid.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/kernel/pid.c b/kernel/pid.c index f55189a3d07d4..d01d0dd7114b2 100644 --- a/kernel/pid.c +++ b/kernel/pid.c @@ -324,8 +324,10 @@ struct pid *alloc_pid(struct pid_namespace *ns, pid_t *arg_set_tid, * error path may try to wakeup the possibly freed ns->child_reaper. */ retval = -ENOMEM; - if (unlikely(!(ns->pid_allocated & PIDNS_ADDING))) - goto out_free; + for (upid = pid->numbers + ns->level; upid >= pid->numbers; --upid) + if (unlikely(!(upid->ns->pid_allocated & PIDNS_ADDING))) + goto out_free; + for (upid = pid->numbers + ns->level; upid >= pid->numbers; --upid) { /* Make the PID visible to find_pid_ns. */ idr_replace(&upid->ns->idr, pid, upid->nr); -- 2.47.3