Imagine posible code path in sget_userns: we iterate in type->fs_supers and do not find suitable sb, we drop sb_lock to allocate s and go to retry. After we dropped sb_lock some other task from different userns takes sb_lock, it is already in retry stage and has s allocated, so it puts its s in type->fs_supers list. So we will find these sb in list and check it has different userns, and finally we return without freeing s.
Signed-off-by: Pavel Tikhomirov <[email protected]> --- fs/super.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/super.c b/fs/super.c index b4ee02b..24771b5 100644 --- a/fs/super.c +++ b/fs/super.c @@ -458,6 +458,10 @@ struct super_block *sget_userns(struct file_system_type *type, continue; if (user_ns != old->s_user_ns) { spin_unlock(&sb_lock); + if (s) { + up_write(&s->s_umount); + destroy_super(s); + } return ERR_PTR(-EBUSY); } if (!grab_super(old)) -- 1.9.3 _______________________________________________ Devel mailing list [email protected] https://lists.openvz.org/mailman/listinfo/devel
