Re: [RFC PATCH v2 1/8] Use atomic type for ucounts reference counting

Re: [RFC PATCH v2 1/8] Use atomic type for ucounts reference counting

[kernel test robot]

[-- Attachment #1: Type: text/plain, Size: 2738 bytes --]

CC: kbuild-all(a)lists.01.org
In-Reply-To: <447547b12bba1894d3f1f79d6408dfc60b219b0c.1610299857.git.gladkov.alexey@gmail.com>
References: <447547b12bba1894d3f1f79d6408dfc60b219b0c.1610299857.git.gladkov.alexey@gmail.com>
TO: Alexey Gladkov <gladkov.alexey@gmail.com>

Hi Alexey,

[FYI, it's a private test report for your RFC patch.]
[auto build test WARNING on linus/master]
[also build test WARNING on hnaz-linux-mm/master v5.11-rc2 next-20210108]
[cannot apply to linux/master kees/for-next/pstore]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]

url:    https://github.com/0day-ci/linux/commits/Alexey-Gladkov/Count-rlimits-in-each-user-namespace/20210111-014938
base:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 2ff90100ace886895e4fbb2850b8d5e49d931ed6
:::::: branch date: 5 hours ago
:::::: commit date: 5 hours ago
config: mips-randconfig-c003-20210111 (attached as .config)
compiler: mips64-linux-gcc (GCC) 9.3.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Julia Lawall <julia.lawall@lip6.fr>


"coccinelle warnings: (new ones prefixed by >>)"
>> kernel/ucount.c:169:5-24: atomic_dec_and_test variation before object free at line 170.
   kernel/ucount.c:169:5-24: atomic_dec_and_test variation before object free at line 175.

vim +169 kernel/ucount.c

f6b2db1a3e8d141d Eric W. Biederman 2016-08-08  163  
f6b2db1a3e8d141d Eric W. Biederman 2016-08-08  164  static void put_ucounts(struct ucounts *ucounts)
f6b2db1a3e8d141d Eric W. Biederman 2016-08-08  165  {
880a38547ff08715 Nikolay Borisov   2017-01-20  166  	unsigned long flags;
880a38547ff08715 Nikolay Borisov   2017-01-20  167  
880a38547ff08715 Nikolay Borisov   2017-01-20  168  	spin_lock_irqsave(&ucounts_lock, flags);
e58c759c8718b56a Alexey Gladkov    2021-01-10 @169  	if (atomic_dec_and_test(&ucounts->count))
f6b2db1a3e8d141d Eric W. Biederman 2016-08-08 @170  		hlist_del_init(&ucounts->node);
040757f738e13caa Eric W. Biederman 2017-03-05  171  	else
040757f738e13caa Eric W. Biederman 2017-03-05  172  		ucounts = NULL;
880a38547ff08715 Nikolay Borisov   2017-01-20  173  	spin_unlock_irqrestore(&ucounts_lock, flags);
f6b2db1a3e8d141d Eric W. Biederman 2016-08-08  174  
f6b2db1a3e8d141d Eric W. Biederman 2016-08-08  175  	kfree(ucounts);
f6b2db1a3e8d141d Eric W. Biederman 2016-08-08  176  }
f6b2db1a3e8d141d Eric W. Biederman 2016-08-08  177  

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org

[-- Attachment #2: config.gz --]
[-- Type: application/gzip, Size: 38685 bytes --]

[RFC PATCH v2 0/8] Count rlimits in each user namespace

[Alexey Gladkov]

Preface
-------
These patches are for binding the rlimit counters to a user in user namespace.
This patch set can be applied on top of:

git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git v5.11-rc2

Problem
-------
Some rlimits are set per user: RLIMIT_NPROC, RLIMIT_MEMLOCK, RLIMIT_SIGPENDING,
RLIMIT_MSGQUEUE. When several containers are created from one user then
the processes inside the containers influence each other.

Eric W. Biederman mentioned this issue [1][2][3].

For example, there are two containers (A and B) created by one user. The
container A sets RLIMIT_NPROC=1 and starts one process. Everything is fine, but
when container B tries to do the same it will fail because the number of
processes is counted globally for each user and user has one process already.

On the other hand, we cannot simply calculate the rlimits for each container
separately. This will lead to the fact that the user creating a new user
namespace can create a fork bomb.

Introduced changes
------------------
To address the problem, we bind rlimit counters to each user namespace. The
result is a tree of rlimit counters with the biggest value at the root (aka
init_user_ns). The rlimit counter increment/decrement occurs in the current and
all parent user namespaces.

ToDo
----
* No documentation.
* No tests.

[1] https://lore.kernel.org/containers/87imd2incs.fsf@x220.int.ebiederm.org/
[2] https://lists.linuxfoundation.org/pipermail/containers/2020-August/042096.html
[3] https://lists.linuxfoundation.org/pipermail/containers/2020-October/042524.html

Changelog
---------
v2:
* RLIMIT_MEMLOCK, RLIMIT_SIGPENDING and RLIMIT_MSGQUEUE are migrated to ucounts.
* Added ucounts for pair uid and user namespace into cred.
* Added the ability to increase ucount by more than 1.

v1:
* After discussion with Eric W. Biederman, I increased the size of ucounts to
  atomic_long_t.
* Added ucount_max to avoid the fork bomb.

--

Alexey Gladkov (8):
  Use atomic type for ucounts reference counting
  Add a reference to ucounts for each user
  Increase size of ucounts to atomic_long_t
  Move RLIMIT_NPROC counter to ucounts
  Move RLIMIT_MSGQUEUE counter to ucounts
  Move RLIMIT_SIGPENDING counter to ucounts
  Move RLIMIT_MEMLOCK counter to ucounts
  Move RLIMIT_NPROC check to the place where we increment the counter

 fs/exec.c                      |  2 +-
 fs/hugetlbfs/inode.c           | 17 +++---
 fs/io-wq.c                     | 22 ++++----
 fs/io-wq.h                     |  2 +-
 fs/io_uring.c                  |  2 +-
 fs/proc/array.c                |  2 +-
 include/linux/cred.h           |  3 ++
 include/linux/hugetlb.h        |  3 +-
 include/linux/mm.h             |  4 +-
 include/linux/sched/user.h     |  6 ---
 include/linux/shmem_fs.h       |  2 +-
 include/linux/signal_types.h   |  4 +-
 include/linux/user_namespace.h | 31 +++++++++--
 ipc/mqueue.c                   | 29 +++++-----
 ipc/shm.c                      | 31 ++++++-----
 kernel/cred.c                  | 43 +++++++++++----
 kernel/exit.c                  |  2 +-
 kernel/fork.c                  | 12 +++--
 kernel/signal.c                | 53 ++++++++----------
 kernel/sys.c                   | 13 -----
 kernel/ucount.c                | 99 +++++++++++++++++++++++++++++-----
 kernel/user.c                  |  2 -
 kernel/user_namespace.c        |  7 ++-
 mm/memfd.c                     |  4 +-
 mm/mlock.c                     | 35 +++++-------
 mm/mmap.c                      |  3 +-
 mm/shmem.c                     |  8 +--
 27 files changed, 268 insertions(+), 173 deletions(-)

-- 
2.29.2

_______________________________________________
Containers mailing list
Containers@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/containers

[RFC PATCH v2 1/8] Use atomic type for ucounts reference counting

[Alexey Gladkov]

Signed-off-by: Alexey Gladkov <gladkov.alexey@gmail.com>
---
 include/linux/user_namespace.h |  2 +-
 kernel/ucount.c                | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h
index 64cf8ebdc4ec..84fefa9247c4 100644
--- a/include/linux/user_namespace.h
+++ b/include/linux/user_namespace.h
@@ -92,7 +92,7 @@ struct ucounts {
 	struct hlist_node node;
 	struct user_namespace *ns;
 	kuid_t uid;
-	int count;
+	atomic_t count;
 	atomic_t ucount[UCOUNT_COUNTS];
 };
 
diff --git a/kernel/ucount.c b/kernel/ucount.c
index 11b1596e2542..0f2c7c11df19 100644
--- a/kernel/ucount.c
+++ b/kernel/ucount.c
@@ -141,7 +141,8 @@ static struct ucounts *get_ucounts(struct user_namespace *ns, kuid_t uid)
 
 		new->ns = ns;
 		new->uid = uid;
-		new->count = 0;
+
+		atomic_set(&new->count, 0);
 
 		spin_lock_irq(&ucounts_lock);
 		ucounts = find_ucounts(ns, uid, hashent);
@@ -152,10 +153,10 @@ static struct ucounts *get_ucounts(struct user_namespace *ns, kuid_t uid)
 			ucounts = new;
 		}
 	}
-	if (ucounts->count == INT_MAX)
+	if (atomic_read(&ucounts->count) == INT_MAX)
 		ucounts = NULL;
 	else
-		ucounts->count += 1;
+		atomic_inc(&ucounts->count);
 	spin_unlock_irq(&ucounts_lock);
 	return ucounts;
 }
@@ -165,8 +166,7 @@ static void put_ucounts(struct ucounts *ucounts)
 	unsigned long flags;
 
 	spin_lock_irqsave(&ucounts_lock, flags);
-	ucounts->count -= 1;
-	if (!ucounts->count)
+	if (atomic_dec_and_test(&ucounts->count))
 		hlist_del_init(&ucounts->node);
 	else
 		ucounts = NULL;
-- 
2.29.2

_______________________________________________
Containers mailing list
Containers@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/containers

[RFC PATCH v2 1/8] Use atomic type for ucounts reference counting

[Alexey Gladkov]

Signed-off-by: Alexey Gladkov <gladkov.alexey@gmail.com>
---
 include/linux/user_namespace.h |  2 +-
 kernel/ucount.c                | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h
index 64cf8ebdc4ec..84fefa9247c4 100644
--- a/include/linux/user_namespace.h
+++ b/include/linux/user_namespace.h
@@ -92,7 +92,7 @@ struct ucounts {
 	struct hlist_node node;
 	struct user_namespace *ns;
 	kuid_t uid;
-	int count;
+	atomic_t count;
 	atomic_t ucount[UCOUNT_COUNTS];
 };
 
diff --git a/kernel/ucount.c b/kernel/ucount.c
index 11b1596e2542..0f2c7c11df19 100644
--- a/kernel/ucount.c
+++ b/kernel/ucount.c
@@ -141,7 +141,8 @@ static struct ucounts *get_ucounts(struct user_namespace *ns, kuid_t uid)
 
 		new->ns = ns;
 		new->uid = uid;
-		new->count = 0;
+
+		atomic_set(&new->count, 0);
 
 		spin_lock_irq(&ucounts_lock);
 		ucounts = find_ucounts(ns, uid, hashent);
@@ -152,10 +153,10 @@ static struct ucounts *get_ucounts(struct user_namespace *ns, kuid_t uid)
 			ucounts = new;
 		}
 	}
-	if (ucounts->count == INT_MAX)
+	if (atomic_read(&ucounts->count) == INT_MAX)
 		ucounts = NULL;
 	else
-		ucounts->count += 1;
+		atomic_inc(&ucounts->count);
 	spin_unlock_irq(&ucounts_lock);
 	return ucounts;
 }
@@ -165,8 +166,7 @@ static void put_ucounts(struct ucounts *ucounts)
 	unsigned long flags;
 
 	spin_lock_irqsave(&ucounts_lock, flags);
-	ucounts->count -= 1;
-	if (!ucounts->count)
+	if (atomic_dec_and_test(&ucounts->count))
 		hlist_del_init(&ucounts->node);
 	else
 		ucounts = NULL;
-- 
2.29.2

Re: [RFC PATCH v2 1/8] Use atomic type for ucounts reference counting

[Eric W. Biederman]

Alexey Gladkov <gladkov.alexey@gmail.com> writes:

We might want to use refcount_t instead of atomic_t.  Not a big deal
either way.

> Signed-off-by: Alexey Gladkov <gladkov.alexey@gmail.com>
> ---
>  include/linux/user_namespace.h |  2 +-
>  kernel/ucount.c                | 10 +++++-----
>  2 files changed, 6 insertions(+), 6 deletions(-)
>
> diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h
> index 64cf8ebdc4ec..84fefa9247c4 100644
> --- a/include/linux/user_namespace.h
> +++ b/include/linux/user_namespace.h
> @@ -92,7 +92,7 @@ struct ucounts {
>  	struct hlist_node node;
>  	struct user_namespace *ns;
>  	kuid_t uid;
> -	int count;
> +	atomic_t count;
>  	atomic_t ucount[UCOUNT_COUNTS];
>  };
>  
> diff --git a/kernel/ucount.c b/kernel/ucount.c
> index 11b1596e2542..0f2c7c11df19 100644
> --- a/kernel/ucount.c
> +++ b/kernel/ucount.c
> @@ -141,7 +141,8 @@ static struct ucounts *get_ucounts(struct user_namespace *ns, kuid_t uid)
>  
>  		new->ns = ns;
>  		new->uid = uid;
> -		new->count = 0;
> +
> +		atomic_set(&new->count, 0);
>  
>  		spin_lock_irq(&ucounts_lock);
>  		ucounts = find_ucounts(ns, uid, hashent);
> @@ -152,10 +153,10 @@ static struct ucounts *get_ucounts(struct user_namespace *ns, kuid_t uid)
>  			ucounts = new;
>  		}
>  	}
> -	if (ucounts->count == INT_MAX)
> +	if (atomic_read(&ucounts->count) == INT_MAX)
>  		ucounts = NULL;
>  	else
> -		ucounts->count += 1;
> +		atomic_inc(&ucounts->count);
>  	spin_unlock_irq(&ucounts_lock);
>  	return ucounts;
>  }
> @@ -165,8 +166,7 @@ static void put_ucounts(struct ucounts *ucounts)
>  	unsigned long flags;
>  
>  	spin_lock_irqsave(&ucounts_lock, flags);
> -	ucounts->count -= 1;
> -	if (!ucounts->count)
> +	if (atomic_dec_and_test(&ucounts->count))
>  		hlist_del_init(&ucounts->node);
>  	else
>  		ucounts = NULL;


This can become:
static void put_ucounts(struct ucounts *ucounts)
{
	unsigned long flags;

        if (atomic_dec_and_lock_irqsave(&ucounts->count, &ucounts_lock, flags)) {
        	hlist_del_init(&ucounts->node);
                spin_unlock_irqrestore(&ucounts_lock);
                kfree(ucounts);
        }
}

_______________________________________________
Containers mailing list
Containers@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/containers

Re: [RFC PATCH v2 1/8] Use atomic type for ucounts reference counting

[Eric W. Biederman]

Alexey Gladkov <gladkov.alexey@gmail.com> writes:

We might want to use refcount_t instead of atomic_t.  Not a big deal
either way.

> Signed-off-by: Alexey Gladkov <gladkov.alexey@gmail.com>
> ---
>  include/linux/user_namespace.h |  2 +-
>  kernel/ucount.c                | 10 +++++-----
>  2 files changed, 6 insertions(+), 6 deletions(-)
>
> diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h
> index 64cf8ebdc4ec..84fefa9247c4 100644
> --- a/include/linux/user_namespace.h
> +++ b/include/linux/user_namespace.h
> @@ -92,7 +92,7 @@ struct ucounts {
>  	struct hlist_node node;
>  	struct user_namespace *ns;
>  	kuid_t uid;
> -	int count;
> +	atomic_t count;
>  	atomic_t ucount[UCOUNT_COUNTS];
>  };
>  
> diff --git a/kernel/ucount.c b/kernel/ucount.c
> index 11b1596e2542..0f2c7c11df19 100644
> --- a/kernel/ucount.c
> +++ b/kernel/ucount.c
> @@ -141,7 +141,8 @@ static struct ucounts *get_ucounts(struct user_namespace *ns, kuid_t uid)
>  
>  		new->ns = ns;
>  		new->uid = uid;
> -		new->count = 0;
> +
> +		atomic_set(&new->count, 0);
>  
>  		spin_lock_irq(&ucounts_lock);
>  		ucounts = find_ucounts(ns, uid, hashent);
> @@ -152,10 +153,10 @@ static struct ucounts *get_ucounts(struct user_namespace *ns, kuid_t uid)
>  			ucounts = new;
>  		}
>  	}
> -	if (ucounts->count == INT_MAX)
> +	if (atomic_read(&ucounts->count) == INT_MAX)
>  		ucounts = NULL;
>  	else
> -		ucounts->count += 1;
> +		atomic_inc(&ucounts->count);
>  	spin_unlock_irq(&ucounts_lock);
>  	return ucounts;
>  }
> @@ -165,8 +166,7 @@ static void put_ucounts(struct ucounts *ucounts)
>  	unsigned long flags;
>  
>  	spin_lock_irqsave(&ucounts_lock, flags);
> -	ucounts->count -= 1;
> -	if (!ucounts->count)
> +	if (atomic_dec_and_test(&ucounts->count))
>  		hlist_del_init(&ucounts->node);
>  	else
>  		ucounts = NULL;


This can become:
static void put_ucounts(struct ucounts *ucounts)
{
	unsigned long flags;

        if (atomic_dec_and_lock_irqsave(&ucounts->count, &ucounts_lock, flags)) {
        	hlist_del_init(&ucounts->node);
                spin_unlock_irqrestore(&ucounts_lock);
                kfree(ucounts);
        }
}

Re: [RFC PATCH v2 1/8] Use atomic type for ucounts reference counting

[Kees Cook]

On Wed, Jan 13, 2021 at 10:31:40AM -0600, Eric W. Biederman wrote:
> Alexey Gladkov <gladkov.alexey@gmail.com> writes:
> 
> We might want to use refcount_t instead of atomic_t.  Not a big deal
> either way.

Yes, please use refcount_t, and don't use _read() since that introduces
races.

-Kees

> 
> > Signed-off-by: Alexey Gladkov <gladkov.alexey@gmail.com>
> > ---
> >  include/linux/user_namespace.h |  2 +-
> >  kernel/ucount.c                | 10 +++++-----
> >  2 files changed, 6 insertions(+), 6 deletions(-)
> >
> > diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h
> > index 64cf8ebdc4ec..84fefa9247c4 100644
> > --- a/include/linux/user_namespace.h
> > +++ b/include/linux/user_namespace.h
> > @@ -92,7 +92,7 @@ struct ucounts {
> >  	struct hlist_node node;
> >  	struct user_namespace *ns;
> >  	kuid_t uid;
> > -	int count;
> > +	atomic_t count;
> >  	atomic_t ucount[UCOUNT_COUNTS];
> >  };
> >  
> > diff --git a/kernel/ucount.c b/kernel/ucount.c
> > index 11b1596e2542..0f2c7c11df19 100644
> > --- a/kernel/ucount.c
> > +++ b/kernel/ucount.c
> > @@ -141,7 +141,8 @@ static struct ucounts *get_ucounts(struct user_namespace *ns, kuid_t uid)
> >  
> >  		new->ns = ns;
> >  		new->uid = uid;
> > -		new->count = 0;
> > +
> > +		atomic_set(&new->count, 0);
> >  
> >  		spin_lock_irq(&ucounts_lock);
> >  		ucounts = find_ucounts(ns, uid, hashent);
> > @@ -152,10 +153,10 @@ static struct ucounts *get_ucounts(struct user_namespace *ns, kuid_t uid)
> >  			ucounts = new;
> >  		}
> >  	}
> > -	if (ucounts->count == INT_MAX)
> > +	if (atomic_read(&ucounts->count) == INT_MAX)
> >  		ucounts = NULL;
> >  	else
> > -		ucounts->count += 1;
> > +		atomic_inc(&ucounts->count);
> >  	spin_unlock_irq(&ucounts_lock);
> >  	return ucounts;
> >  }
> > @@ -165,8 +166,7 @@ static void put_ucounts(struct ucounts *ucounts)
> >  	unsigned long flags;
> >  
> >  	spin_lock_irqsave(&ucounts_lock, flags);
> > -	ucounts->count -= 1;
> > -	if (!ucounts->count)
> > +	if (atomic_dec_and_test(&ucounts->count))
> >  		hlist_del_init(&ucounts->node);
> >  	else
> >  		ucounts = NULL;
> 
> 
> This can become:
> static void put_ucounts(struct ucounts *ucounts)
> {
> 	unsigned long flags;
> 
>         if (atomic_dec_and_lock_irqsave(&ucounts->count, &ucounts_lock, flags)) {
>         	hlist_del_init(&ucounts->node);
>                 spin_unlock_irqrestore(&ucounts_lock);
>                 kfree(ucounts);
>         }
> }
> 

-- 
Kees Cook
_______________________________________________
Containers mailing list
Containers@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/containers

Re: [RFC PATCH v2 1/8] Use atomic type for ucounts reference counting

[Kees Cook]

On Wed, Jan 13, 2021 at 10:31:40AM -0600, Eric W. Biederman wrote:
> Alexey Gladkov <gladkov.alexey@gmail.com> writes:
> 
> We might want to use refcount_t instead of atomic_t.  Not a big deal
> either way.

Yes, please use refcount_t, and don't use _read() since that introduces
races.

-Kees

> 
> > Signed-off-by: Alexey Gladkov <gladkov.alexey@gmail.com>
> > ---
> >  include/linux/user_namespace.h |  2 +-
> >  kernel/ucount.c                | 10 +++++-----
> >  2 files changed, 6 insertions(+), 6 deletions(-)
> >
> > diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h
> > index 64cf8ebdc4ec..84fefa9247c4 100644
> > --- a/include/linux/user_namespace.h
> > +++ b/include/linux/user_namespace.h
> > @@ -92,7 +92,7 @@ struct ucounts {
> >  	struct hlist_node node;
> >  	struct user_namespace *ns;
> >  	kuid_t uid;
> > -	int count;
> > +	atomic_t count;
> >  	atomic_t ucount[UCOUNT_COUNTS];
> >  };
> >  
> > diff --git a/kernel/ucount.c b/kernel/ucount.c
> > index 11b1596e2542..0f2c7c11df19 100644
> > --- a/kernel/ucount.c
> > +++ b/kernel/ucount.c
> > @@ -141,7 +141,8 @@ static struct ucounts *get_ucounts(struct user_namespace *ns, kuid_t uid)
> >  
> >  		new->ns = ns;
> >  		new->uid = uid;
> > -		new->count = 0;
> > +
> > +		atomic_set(&new->count, 0);
> >  
> >  		spin_lock_irq(&ucounts_lock);
> >  		ucounts = find_ucounts(ns, uid, hashent);
> > @@ -152,10 +153,10 @@ static struct ucounts *get_ucounts(struct user_namespace *ns, kuid_t uid)
> >  			ucounts = new;
> >  		}
> >  	}
> > -	if (ucounts->count == INT_MAX)
> > +	if (atomic_read(&ucounts->count) == INT_MAX)
> >  		ucounts = NULL;
> >  	else
> > -		ucounts->count += 1;
> > +		atomic_inc(&ucounts->count);
> >  	spin_unlock_irq(&ucounts_lock);
> >  	return ucounts;
> >  }
> > @@ -165,8 +166,7 @@ static void put_ucounts(struct ucounts *ucounts)
> >  	unsigned long flags;
> >  
> >  	spin_lock_irqsave(&ucounts_lock, flags);
> > -	ucounts->count -= 1;
> > -	if (!ucounts->count)
> > +	if (atomic_dec_and_test(&ucounts->count))
> >  		hlist_del_init(&ucounts->node);
> >  	else
> >  		ucounts = NULL;
> 
> 
> This can become:
> static void put_ucounts(struct ucounts *ucounts)
> {
> 	unsigned long flags;
> 
>         if (atomic_dec_and_lock_irqsave(&ucounts->count, &ucounts_lock, flags)) {
>         	hlist_del_init(&ucounts->node);
>                 spin_unlock_irqrestore(&ucounts_lock);
>                 kfree(ucounts);
>         }
> }
> 

-- 
Kees Cook