copy_cgroup_ns() sets the root of a new cgroup namespace to the parent's
css_set. When the child is created in a different cgroup,
cgroup_post_fork() replaces that root with the child's css_set after the
namespace is visible.

Publishing the namespace before root_cset is final lets readers race with
cgroup_post_fork(). A reader can load the old root just before it is
replaced and its reference is dropped, then continue using the freed
css_set. KASAN reports:

  BUG: KASAN: slab-use-after-free in kernfs_get.part.0+0x47/0x60
  Write of size 4 at addr ff1100000379f320 by task ns-path-probe/69
   kernfs_walk_and_get_ns+0x1cc/0x280
   cgroup_get_from_path+0xfb/0x340
   nft_socket_cgroup_subtree_level+0x14/0x1a0

Finalize root_cset before adding the namespace to the tree. Allocate the
namespace ID at creation, add unshared namespaces after creation succeeds,
and only remove namespaces that were added.

Fixes: ef2c41cf38a7 ("clone3: allow spawning processes into cgroups")
Assisted-by: LLM
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
---
Changes in v2:
- Finalize root_cset before publication.
- Defer tree insertion on fork.
- Handle unshare and failed forks.

v1: https://lore.kernel.org/all/20260923204935.2253203-2-Jeremy.Jean@oss.cyber.gouv.fr/

 kernel/cgroup/cgroup.c    | 22 +++++++++++++---------
 kernel/cgroup/namespace.c |  5 +++--
 kernel/nsproxy.c          |  5 +++++
 3 files changed, 21 insertions(+), 11 deletions(-)

diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 227d09704ca5..78f6d235c19b 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -7009,6 +7009,19 @@ int cgroup_can_fork(struct task_struct *child, struct kernel_clone_args *kargs)
 			goto out_revert;
 	} while_each_subsys_mask();
 
+	/* Publish a new cgroup namespace only after its root is final. */
+	if (kargs->flags & CLONE_NEWCGROUP) {
+		struct cgroup_namespace *ns = child->nsproxy->cgroup_ns;
+		struct css_set *rcset = ns->root_cset;
+
+		if (rcset != kargs->cset) {
+			get_css_set(kargs->cset);
+			ns->root_cset = kargs->cset;
+			put_css_set(rcset);
+		}
+		ns_tree_add_raw(ns);
+	}
+
 	return 0;
 
 out_revert:
@@ -7127,15 +7140,6 @@ void cgroup_post_fork(struct task_struct *child,
 		ss->fork(child);
 	} while_each_subsys_mask();
 
-	/* Make the new cset the root_cset of the new cgroup namespace. */
-	if (kargs->flags & CLONE_NEWCGROUP) {
-		struct css_set *rcset = child->nsproxy->cgroup_ns->root_cset;
-
-		get_css_set(cset);
-		child->nsproxy->cgroup_ns->root_cset = cset;
-		put_css_set(rcset);
-	}
-
 	/* Cgroup has to be killed so take down child immediately. */
 	if (unlikely(kill))
 		do_send_sig_info(SIGKILL, SEND_SIG_NOINFO, child, PIDTYPE_TGID);
diff --git a/kernel/cgroup/namespace.c b/kernel/cgroup/namespace.c
index ea4ee13936be..6c8ac36231d9 100644
--- a/kernel/cgroup/namespace.c
+++ b/kernel/cgroup/namespace.c
@@ -30,12 +30,14 @@ static struct cgroup_namespace *alloc_cgroup_ns(void)
 	ret = ns_common_init(new_ns);
 	if (ret)
 		return ERR_PTR(ret);
+	ns_tree_gen_id(new_ns);
 	return no_free_ptr(new_ns);
 }
 
 void free_cgroup_ns(struct cgroup_namespace *ns)
 {
-	ns_tree_remove(ns);
+	if (ns_tree_active(ns))
+		ns_tree_remove(ns);
 	put_css_set(ns->root_cset);
 	dec_cgroup_namespaces(ns->ucounts);
 	put_user_ns(ns->user_ns);
@@ -85,7 +87,6 @@ struct cgroup_namespace *copy_cgroup_ns(u64 flags,
 	new_ns->ucounts = ucounts;
 	new_ns->root_cset = cset;
 
-	ns_tree_add(new_ns);
 	return new_ns;
 }
 
diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c
index d9d3d5973bf5..01c4dcf26993 100644
--- a/kernel/nsproxy.c
+++ b/kernel/nsproxy.c
@@ -238,6 +238,11 @@ int unshare_nsproxy_namespaces(unsigned long unshare_flags,
 		goto out;
 	}
 
+#ifdef CONFIG_CGROUPS
+	if (flags & CLONE_NEWCGROUP)
+		ns_tree_add_raw((*new_nsp)->cgroup_ns);
+#endif
+
 out:
 	return err;
 }
-- 
2.47.3