Re: [PATCH] proc: Fix broken error paths for namespace links

On 7/6/26 20:22, Jann Horn wrote:
> Don't return the return value of down_read_killable() (0) when a ptrace
> access check fails, return -EACCES as intended.
> 
> Reported-by: Magnus Lindholm <[email protected]>
> Closes: https://lore.kernel.org/r/[email protected]
> Fixes: 6650527444da ("proc: protect ptrace_may_access() with exec_update_lock (part 1)")

Wondering is this regression fix fell through the cracks. Or was Magnus'
problem (several strace --pidns-translation tests started failing) fixed
some other way and I just missed it?

Side note: the culprit meanwhile made it to 7.1.4.

Ciao, Thorsten

> Cc: [email protected]
> Signed-off-by: Jann Horn <[email protected]>
> ---
>  fs/proc/namespaces.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/proc/namespaces.c b/fs/proc/namespaces.c
> index 2f46f1396744..ea6ec61a0430 100644
> --- a/fs/proc/namespaces.c
> +++ b/fs/proc/namespaces.c
> @@ -46,7 +46,7 @@ static const char *proc_ns_get_link(struct dentry *dentry,
>  	const struct proc_ns_operations *ns_ops = PROC_I(inode)->ns_ops;
>  	struct task_struct *task;
>  	struct path ns_path;
> -	int error = -EACCES;
> +	int error;
>  
>  	if (!dentry)
>  		return ERR_PTR(-ECHILD);
> @@ -59,6 +59,7 @@ static const char *proc_ns_get_link(struct dentry *dentry,
>  	if (error)
>  		goto out_put_task;
>  
> +	error = -EACCES;
>  	if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS))
>  		goto out;
>  
> @@ -90,6 +91,7 @@ static int proc_ns_readlink(struct dentry *dentry, char __user *buffer, int bufl
>  	if (res)
>  		goto out_put_task;
>  
> +	res = -EACCES;
>  	if (ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS)) {
>  		res = ns_get_name(name, sizeof(name), task, ns_ops);
>  		if (res >= 0)
> 
> ---
> base-commit: 8cdeaa50eae8dad34885515f62559ee83e7e8dda
> change-id: 20260706-procfs-ns-eacces-fix-3abd8e307936
> 
> Best regards,
> --  
> Jann Horn <[email protected]>
> 
>