Changes in regression_pidfd_setns_test.c

cc4adab164b772a34b3340d644b7c4728498581e - Merge tag 'v6.19-rc1' into msm-next

Tue, 20 Jan 2026 22:06:55 +0000

Merge tag 'v6.19-rc1' into msm-nextMerge Linux 6.19-rc1 in order to catch up with other changes (e.g. UBWCconfig database defining UBWC_6).Signed-off-by: Dmitry Baryshkov List of files: /linux/tools/testing/selftests/namespaces/regression_pidfd_setns_test.c

5add3c3c280a35f7e258e9cef7607db5a2e56fdc - Merge drm/drm-next into drm-xe-next

Fri, 19 Dec 2025 10:51:22 +0000

Merge drm/drm-next into drm-xe-nextBackmerging to bring in 6.19-rc1. An important upstream bugfix andto help unblock PTL CI.Signed-off-by: Thomas Hellström List of files: /linux/tools/testing/selftests/namespaces/regression_pidfd_setns_test.c

b8304863a3990d0f18c38e5b94191830a63ee1af - Merge drm/drm-next into drm-intel-next

Mon, 15 Dec 2025 13:24:02 +0000

Merge drm/drm-next into drm-intel-nextSync-up some display code needed for Async flips refactor.Signed-off-by: Rodrigo Vivi List of files: /linux/tools/testing/selftests/namespaces/regression_pidfd_setns_test.c

7f790dd21a931c61167f7bdc327aecf2cebad327 - Merge drm/drm-next into drm-misc-next

Mon, 15 Dec 2025 08:27:39 +0000

Merge drm/drm-next into drm-misc-nextLet's kickstart the v6.20 (7.0?) release cycle.Signed-off-by: Maxime Ripard List of files: /linux/tools/testing/selftests/namespaces/regression_pidfd_setns_test.c

24f171c7e145f43b9f187578e89b0982ce87e54c - Merge tag 'asoc-fix-v6.19-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

Sun, 21 Dec 2025 10:11:11 +0000

Merge tag 'asoc-fix-v6.19-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linusASoC: Fixes for v6.19We've been quite busy with fixes since the merge window, though not inany particularly exciting ways - the standout thing is the fix for _SXcontrols which were broken by a change to how we do clamping, otherwiseit's all fairly run of the mill fixes and quirks. List of files: /linux/tools/testing/selftests/namespaces/regression_pidfd_setns_test.c

84318277d6334c6981ab326d4acc87c6a6ddc9b8 - Merge remote-tracking branch 'drm/drm-fixes' into drm-misc-fixes

Mon, 15 Dec 2025 11:53:27 +0000

Merge remote-tracking branch 'drm/drm-fixes' into drm-misc-fixesPull in rc1 to include all changes since the merge window closed,and grab all fixes and changes from drm/drm-next.Signed-off-by: Maarten Lankhorst List of files: /linux/tools/testing/selftests/namespaces/regression_pidfd_setns_test.c

415d34b92c1f921a9ff3c38f56319cbc5536f642 - Merge tag 'namespace-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Mon, 01 Dec 2025 17:47:41 +0000

Merge tag 'namespace-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfsPull namespace updates from Christian Brauner: "This contains substantial namespace infrastructure changes including a new system call, active reference counting, and extensive header cleanups. The branch depends on the shared kbuild branch for -fms-extensions support. Features: - listns() system call Add a new listns() system call that allows userspace to iterate through namespaces in the system. This provides a programmatic interface to discover and inspect namespaces, addressing longstanding limitations: Currently, there is no direct way for userspace to enumerate namespaces. Applications must resort to scanning /proc/*/ns/ across all processes, which is: - Inefficient - requires iterating over all processes - Incomplete - misses namespaces not attached to any running process but kept alive by file descriptors, bind mounts, or parent references - Permission-heavy - requires access to /proc for many processes - No ordering or ownership information - No filtering per namespace type The listns() system call solves these problems: ssize_t listns(const struct ns_id_req *req, u64 *ns_ids, size_t nr_ns_ids, unsigned int flags); struct ns_id_req { __u32 size; __u32 spare; __u64 ns_id; struct /* listns */ { __u32 ns_type; __u32 spare2; __u64 user_ns_id; }; }; Features include: - Pagination support for large namespace sets - Filtering by namespace type (MNT_NS, NET_NS, USER_NS, etc.) - Filtering by owning user namespace - Permission checks respecting namespace isolation - Active Reference Counting Introduce an active reference count that tracks namespace visibility to userspace. A namespace is visible in the following cases: - The namespace is in use by a task - The namespace is persisted through a VFS object (namespace file descriptor or bind-mount) - The namespace is a hierarchical type and is the parent of child namespaces The active reference count does not regulate lifetime (that's still done by the normal reference count) - it only regulates visibility to namespace file handles and listns(). This prevents resurrection of namespaces that are pinned only for internal kernel reasons (e.g., user namespaces held by file->f_cred, lazy TLB references on idle CPUs, etc.) which should not be accessible via (1)-(3). - Unified Namespace Tree Introduce a unified tree structure for all namespaces with: - Fixed IDs assigned to initial namespaces - Lookup based solely on inode number - Maintained list of owned namespaces per user namespace - Simplified rbtree comparison helpers Cleanups - Header Reorganization: - Move namespace types into separate header (ns_common_types.h) - Decouple nstree from ns_common header - Move nstree types into separate header - Switch to new ns_tree_{node,root} structures with helper functions - Use guards for ns_tree_lock - Initial Namespace Reference Count Optimization - Make all reference counts on initial namespaces a nop to avoid pointless cacheline ping-pong for namespaces that can never go away - Drop custom reference count initialization for initial namespaces - Add NS_COMMON_INIT() macro and use it for all namespaces - pid: rely on common reference count behavior - Miscellaneous Cleanups - Rename exit_task_namespaces() to exit_nsproxy_namespaces() - Rename is_initial_namespace() and make argument const - Use boolean to indicate anonymous mount namespace - Simplify owner list iteration in nstree - nsfs: raise SB_I_NODEV, SB_I_NOEXEC, and DCACHE_DONTCACHE explicitly - nsfs: use inode_just_drop() - pidfs: raise DCACHE_DONTCACHE explicitly - pidfs: simplify PIDFD_GET__NAMESPACE ioctls - libfs: allow to specify s_d_flags - cgroup: add cgroup namespace to tree after owner is set - nsproxy: fix free_nsproxy() and simplify create_new_namespaces() Fixes: - setns(pidfd, ...) race condition Fix a subtle race when using pidfds with setns(). When the target task exits after prepare_nsset() but before commit_nsset(), the namespace's active reference count might have been dropped. If setns() then installs the namespaces, it would bump the active reference count from zero without taking the required reference on the owner namespace, leading to underflow when later decremented. The fix resurrects the ownership chain if necessary - if the caller succeeded in grabbing passive references, the setns() should succeed even if the target task exits or gets reaped. - Return EFAULT on put_user() error instead of success - Make sure references are dropped outside of RCU lock (some namespaces like mount namespace sleep when putting the last reference) - Don't skip active reference count initialization for network namespace - Add asserts for active refcount underflow - Add asserts for initial namespace reference counts (both passive and active) - ipc: enable is_ns_init_id() assertions - Fix kernel-doc comments for internal nstree functions - Selftests - 15 active reference count tests - 9 listns() functionality tests - 7 listns() permission tests - 12 inactive namespace resurrection tests - 3 threaded active reference count tests - commit_creds() active reference tests - Pagination and stress tests - EFAULT handling test - nsid tests fixes"* tag 'namespace-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (103 commits) pidfs: simplify PIDFD_GET__NAMESPACE ioctls nstree: fix kernel-doc comments for internal functions nsproxy: fix free_nsproxy() and simplify create_new_namespaces() selftests/namespaces: fix nsid tests ns: drop custom reference count initialization for initial namespaces pid: rely on common reference count behavior ns: add asserts for initial namespace active reference counts ns: add asserts for initial namespace reference counts ns: make all reference counts on initial namespace a nop ipc: enable is_ns_init_id() assertions fs: use boolean to indicate anonymous mount namespace ns: rename is_initial_namespace() ns: make is_initial_namespace() argument const nstree: use guards for ns_tree_lock nstree: simplify owner list iteration nstree: switch to new structures nstree: add helper to operate on struct ns_tree_{node,root} nstree: move nstree types into separate header nstree: decouple from ns_common header ns: move namespace types into separate header ... List of files: /linux/tools/testing/selftests/namespaces/regression_pidfd_setns_test.c

ae901e5e2e9b079761d26a366e0c80530d8aad22 - Merge patch series "ns: fixes for namespace iteration and active reference counting"

Mon, 10 Nov 2025 09:21:00 +0000

Merge patch series "ns: fixes for namespace iteration and active reference counting"Christian Brauner says:* Make sure to initialize the active reference count for the initial network namespace and prevent __ns_common_init() from returning too early.* Make sure that passive reference counts are dropped outside of rcu read locks as some namespaces such as the mount namespace do in fact sleep when putting the last reference.* The setns() system call supports: (1) namespace file descriptors (nsfd) (2) process file descriptors (pidfd) When using nsfds the namespaces will remain active because they are pinned by the vfs. However, when pidfds are used things are more complicated. When the target task exits and passes through exit_nsproxy_namespaces() or is reaped and thus also passes through exit_cred_namespaces() after the setns()'ing task has called prepare_nsset() but before the active reference count of the set of namespaces it wants to setns() to might have been dropped already: P1 P2 pid_p1 = clone(CLONE_NEWUSER | CLONE_NEWNET | CLONE_NEWNS) pidfd = pidfd_open(pid_p1) setns(pidfd, CLONE_NEWUSER | CLONE_NEWNET | CLONE_NEWNS) prepare_nsset() exit(0) // ns->__ns_active_ref == 1 // parent_ns->__ns_active_ref == 1 -> exit_nsproxy_namespaces() -> exit_cred_namespaces() // ns_active_ref_put() will also put // the reference on the owner of the // namespace. If the only reason the // owning namespace was alive was // because it was a parent of @ns // it's active reference count now goes // to zero... -------------------------------- // | // ns->__ns_active_ref == 0 | // parent_ns->__ns_active_ref == 0 | | commit_nsset() -----------------> // If setns() // now manages to install the namespaces // it will call ns_active_ref_get() // on them thus bumping the active reference // count from zero again but without also // taking the required reference on the owner. // Thus we get: // // ns->__ns_active_ref == 1 // parent_ns->__ns_active_ref == 0 When later someone does ns_active_ref_put() on @ns it will underflow parent_ns->__ns_active_ref leading to a splat from our asserts thinking there are still active references when in fact the counter just underflowed. So resurrect the ownership chain if necessary as well. If the caller succeeded to grab passive references to the set of namespaces the setns() should simply succeed even if the target task exists or gets reaped in the meantime. The race is rare and can only be triggered when using pidfs to setns() to namespaces. Also note that active reference on initial namespaces are nops. Since we now always handle parent references directly we can drop ns_ref_active_get_owner() when adding a namespace to a namespace tree. This is now all handled uniformly in the places where the new namespaces actually become active.* patches from https://patch.msgid.link/20251109-namespace-6-19-fixes-v1-0-ae8a4ad5a3b3@kernel.org: selftests/namespaces: test for efault selftests/namespaces: add active reference count regression test ns: add asserts for active refcount underflow ns: handle setns(pidfd, ...) cleanly ns: return EFAULT on put_user() error ns: make sure reference are dropped outside of rcu lock ns: don't increment or decrement initial namespaces ns: don't skip active reference count initializationLink: https://patch.msgid.link/20251109-namespace-6-19-fixes-v1-0-ae8a4ad5a3b3@kernel.orgSigned-off-by: Christian Brauner List of files: /linux/tools/testing/selftests/namespaces/regression_pidfd_setns_test.c

88efd7c6997ee9da3e0274106f72b99fa105f45f - selftests/namespaces: add active reference count regression test

Sun, 09 Nov 2025 21:11:28 +0000

selftests/namespaces: add active reference count regression testAdd a regression test for setns() with pidfd.Link: https://patch.msgid.link/20251109-namespace-6-19-fixes-v1-7-ae8a4ad5a3b3@kernel.orgSigned-off-by: Christian Brauner List of files: /linux/tools/testing/selftests/namespaces/regression_pidfd_setns_test.c