Revision 28f300d23674fa01ae747c66ce861d4ee6aebe8c authored by Pavel Emelyanov on 19 September 2007, 05:46:45 UTC, committed by Linus Torvalds on 19 September 2007, 18:24:18 UTC
It turned out, that the user namespace is released during the do_exit() in exit_task_namespaces(), but the struct user_struct is released only during the put_task_struct(), i.e. MUCH later. On debug kernels with poisoned slabs this will cause the oops in uid_hash_remove() because the head of the chain, which resides inside the struct user_namespace, will be already freed and poisoned. Since the uid hash itself is required only when someone can search it, i.e. when the namespace is alive, we can safely unhash all the user_struct-s from it during the namespace exiting. The subsequent free_uid() will complete the user_struct destruction. For example simple program #include <sched.h> char stack[2 * 1024 * 1024]; int f(void *foo) { return 0; } int main(void) { clone(f, stack + 1 * 1024 * 1024, 0x10000000, 0); return 0; } run on kernel with CONFIG_USER_NS turned on will oops the kernel immediately. This was spotted during OpenVZ kernel testing. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Signed-off-by: Alexey Dobriyan <adobriyan@openvz.org> Acked-by: "Serge E. Hallyn" <serue@us.ibm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent 735de22
sysctl_net_802.c
/* -*- linux-c -*-
* sysctl_net_802.c: sysctl interface to net 802 subsystem.
*
* Begun April 1, 1996, Mike Shaver.
* Added /proc/sys/net/802 directory entry (empty =) ). [MS]
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version
* 2 of the License, or (at your option) any later version.
*/
#include <linux/mm.h>
#include <linux/if_tr.h>
#include <linux/sysctl.h>
#ifdef CONFIG_TR
extern int sysctl_tr_rif_timeout;
#endif
struct ctl_table tr_table[] = {
#ifdef CONFIG_TR
{
.ctl_name = NET_TR_RIF_TIMEOUT,
.procname = "rif_timeout",
.data = &sysctl_tr_rif_timeout,
.maxlen = sizeof(int),
.mode = 0644,
.proc_handler = &proc_dointvec
},
#endif /* CONFIG_TR */
{ 0 },
};
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...