Merge pull request #7353 from avagin:kernfs-lock-inv

PiperOrigin-RevId: 438702683

pkg/sentry/kernel/task_clone.go

@@ -464,6 +464,7 @@ func (t *Task) Unshare(flags int32) error {
 		// new user namespace is used if there is one.
 		t.utsns = t.utsns.Clone(creds.UserNamespace)
 	}
+	var oldIPCNS *IPCNamespace
 	if flags&linux.CLONE_NEWIPC != 0 {
 		if !haveCapSysAdmin {
 			t.mu.Unlock()
@@ -471,7 +472,7 @@ func (t *Task) Unshare(flags int32) error {
 		}
 		// Note that "If CLONE_NEWIPC is set, then create the process in a new IPC
 		// namespace"
-		t.ipcns.DecRef(t)
+		oldIPCNS = t.ipcns
 		t.ipcns = NewIPCNamespace(creds.UserNamespace)
 		if VFS2Enabled {
 			t.ipcns.InitPosixQueues(t, t.k.VFS(), creds)
@@ -488,6 +489,9 @@ func (t *Task) Unshare(flags int32) error {
 		t.fsContext = oldFSContext.Fork()
 	}
 	t.mu.Unlock()
+	if oldIPCNS != nil {
+		oldIPCNS.DecRef(t)
+	}
 	if oldFDTable != nil {
 		oldFDTable.DecRef(t)
 	}

pkg/sentry/kernel/task_exit.go

@@ -252,12 +252,14 @@ func (*runExitMain) execute(t *Task) taskRunState {
 	t.LeaveCgroups()
 
 	t.mu.Lock()
-	if t.mountNamespaceVFS2 != nil {
-		t.mountNamespaceVFS2.DecRef(t)
-		t.mountNamespaceVFS2 = nil
-	}
-	t.ipcns.DecRef(t)
+	mntns := t.mountNamespaceVFS2
+	t.mountNamespaceVFS2 = nil
+	ipcns := t.ipcns
 	t.mu.Unlock()
+	if mntns != nil {
+		mntns.DecRef(t)
+	}
+	ipcns.DecRef(t)
 
 	// If this is the last task to exit from the thread group, release the
 	// thread group's resources.