Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fb5ae64f authored by Serge E. Hallyn's avatar Serge E. Hallyn Committed by Linus Torvalds
Browse files

User namespaces: Only put the userns when we unhash the uid 



uids in namespaces other than init don't get a sysfs entry.

For those in the init namespace, while we're waiting to remove
the sysfs entry for the uid the uid is still hashed, and
alloc_uid() may re-grab that uid without getting a new
reference to the user_ns, which we've already put in free_user
before scheduling remove_user_sysfs_dir().

Reported-and-tested-by: default avatarKOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Signed-off-by: default avatarSerge E. Hallyn <serue@us.ibm.com>
Acked-by: default avatarDavid Howells <dhowells@redhat.com>
Tested-by: default avatarIngo Molnar <mingo@elte.hu>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 37bed900

kernel/user.c

+1 −2
Original line number Original line Diff line number Diff line
@@ -72,6 +72,7 @@ static void uid_hash_insert(struct user_struct *up, struct hlist_head *hashent) 
static void uid_hash_remove(struct user_struct *up)

static void uid_hash_remove(struct user_struct *up)

{

{

	hlist_del_init(&up->uidhash_node);

	hlist_del_init(&up->uidhash_node);

	put_user_ns(up->user_ns);

}

}





static struct user_struct *uid_hash_find(uid_t uid, struct hlist_head *hashent)

static struct user_struct *uid_hash_find(uid_t uid, struct hlist_head *hashent)
@@ -334,7 +335,6 @@ static void free_user(struct user_struct *up, unsigned long flags) 
	atomic_inc(&up->__count);

	atomic_inc(&up->__count);

	spin_unlock_irqrestore(&uidhash_lock, flags);

	spin_unlock_irqrestore(&uidhash_lock, flags);





	put_user_ns(up->user_ns);

	INIT_WORK(&up->work, remove_user_sysfs_dir);

	INIT_WORK(&up->work, remove_user_sysfs_dir);

	schedule_work(&up->work);

	schedule_work(&up->work);

}

}
@@ -357,7 +357,6 @@ static void free_user(struct user_struct *up, unsigned long flags) 
	sched_destroy_user(up);

	sched_destroy_user(up);

	key_put(up->uid_keyring);

	key_put(up->uid_keyring);

	key_put(up->session_keyring);

	key_put(up->session_keyring);

	put_user_ns(up->user_ns);

	kmem_cache_free(uid_cachep, up);

	kmem_cache_free(uid_cachep, up);

}

}