From fedbf08401fe82ab211b4b33c7beb299b55a0536 Mon Sep 17 00:00:00 2001 From: Andrei Vagin Date: Wed, 21 Jun 2023 15:48:11 -0700 Subject: [PATCH] kernel: unshare a network namespace without taking Task.mu t.netns is an atomic pointer so it should not be a problem for readers. As for writers, only task can change its network namespace. Reported-by: syzbot+8e29d377b851dcdfbca2@syzkaller.appspotmail.com Reported-by: syzbot+9ffa998047fce0c57473@syzkaller.appspotmail.com Reported-by: syzbot+c1c75367b97f5e31a12f@syzkaller.appspotmail.com PiperOrigin-RevId: 542384765 --- pkg/sentry/kernel/task_clone.go | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/pkg/sentry/kernel/task_clone.go b/pkg/sentry/kernel/task_clone.go index 04049c8f9..3e494178d 100644 --- a/pkg/sentry/kernel/task_clone.go +++ b/pkg/sentry/kernel/task_clone.go @@ -466,17 +466,16 @@ func (t *Task) Unshare(flags int32) error { } t.childPIDNamespace = t.tg.pidns.NewChild(t.UserNamespace()) } - t.mu.Lock() - // Can't defer unlock: DecRefs must occur without holding t.mu. var oldNETNS *inet.Namespace if flags&linux.CLONE_NEWNET != 0 { if !haveCapSysAdmin { - t.mu.Unlock() return linuxerr.EPERM } oldNETNS = t.netns.Load() t.netns.Store(inet.NewNamespace(t.netns.Load())) } + t.mu.Lock() + // Can't defer unlock: DecRefs must occur without holding t.mu. if flags&linux.CLONE_NEWUTS != 0 { if !haveCapSysAdmin { t.mu.Unlock()