Gitweb:     
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=28f300d23674fa01ae747c66ce861d4ee6aebe8c
Commit:     28f300d23674fa01ae747c66ce861d4ee6aebe8c
Parent:     735de2230f09741077a645a913de0a04b10208bf
Author:     Pavel Emelyanov <[EMAIL PROTECTED]>
AuthorDate: Tue Sep 18 22:46:45 2007 -0700
Committer:  Linus Torvalds <[EMAIL PROTECTED]>
CommitDate: Wed Sep 19 11:24:18 2007 -0700

    Fix user namespace exiting OOPs
    
    It turned out, that the user namespace is released during the do_exit() in
    exit_task_namespaces(), but the struct user_struct is released only during 
the
    put_task_struct(), i.e.  MUCH later.
    
    On debug kernels with poisoned slabs this will cause the oops in
    uid_hash_remove() because the head of the chain, which resides inside the
    struct user_namespace, will be already freed and poisoned.
    
    Since the uid hash itself is required only when someone can search it, i.e.
    when the namespace is alive, we can safely unhash all the user_struct-s from
    it during the namespace exiting.  The subsequent free_uid() will complete 
the
    user_struct destruction.
    
    For example simple program
    
       #include <sched.h>
    
       char stack[2 * 1024 * 1024];
    
       int f(void *foo)
       {
        return 0;
       }
    
       int main(void)
       {
        clone(f, stack + 1 * 1024 * 1024, 0x10000000, 0);
        return 0;
       }
    
    run on kernel with CONFIG_USER_NS turned on will oops the
    kernel immediately.
    
    This was spotted during OpenVZ kernel testing.
    
    Signed-off-by: Pavel Emelyanov <[EMAIL PROTECTED]>
    Signed-off-by: Alexey Dobriyan <[EMAIL PROTECTED]>
    Acked-by: "Serge E. Hallyn" <[EMAIL PROTECTED]>
    Signed-off-by: Andrew Morton <[EMAIL PROTECTED]>
    Signed-off-by: Linus Torvalds <[EMAIL PROTECTED]>
---
 include/linux/sched.h   |    1 +
 kernel/user.c           |   26 +++++++++++++++++++++++++-
 kernel/user_namespace.c |    2 +-
 3 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/include/linux/sched.h b/include/linux/sched.h
index 6239bc2..5445eae 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1472,6 +1472,7 @@ static inline struct user_struct *get_uid(struct 
user_struct *u)
 }
 extern void free_uid(struct user_struct *);
 extern void switch_uid(struct user_struct *);
+extern void release_uids(struct user_namespace *ns);
 
 #include <asm/current.h>
 
diff --git a/kernel/user.c b/kernel/user.c
index add57c7..9ca2848 100644
--- a/kernel/user.c
+++ b/kernel/user.c
@@ -62,7 +62,7 @@ static inline void uid_hash_insert(struct user_struct *up, 
struct hlist_head *ha
 
 static inline void uid_hash_remove(struct user_struct *up)
 {
-       hlist_del(&up->uidhash_node);
+       hlist_del_init(&up->uidhash_node);
 }
 
 static inline struct user_struct *uid_hash_find(uid_t uid, struct hlist_head 
*hashent)
@@ -199,6 +199,30 @@ void switch_uid(struct user_struct *new_user)
        suid_keys(current);
 }
 
+void release_uids(struct user_namespace *ns)
+{
+       int i;
+       unsigned long flags;
+       struct hlist_head *head;
+       struct hlist_node *nd;
+
+       spin_lock_irqsave(&uidhash_lock, flags);
+       /*
+        * collapse the chains so that the user_struct-s will
+        * be still alive, but not in hashes. subsequent free_uid()
+        * will free them.
+        */
+       for (i = 0; i < UIDHASH_SZ; i++) {
+               head = ns->uidhash_table + i;
+               while (!hlist_empty(head)) {
+                       nd = head->first;
+                       hlist_del_init(nd);
+               }
+       }
+       spin_unlock_irqrestore(&uidhash_lock, flags);
+
+       free_uid(ns->root_user);
+}
 
 static int __init uid_cache_init(void)
 {
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index e7ba1bf..7af90fc 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -81,7 +81,7 @@ void free_user_ns(struct kref *kref)
        struct user_namespace *ns;
 
        ns = container_of(kref, struct user_namespace, kref);
-       free_uid(ns->root_user);
+       release_uids(ns);
        kfree(ns);
 }
 
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to