[PATCH] User namespaces: Only put the userns when we unhash the uid

[PATCH] User namespaces: Only put the userns when we unhash the uid

[David Howells]

From: Serge E. Hallyn <serue@us.ibm.com>

uids in namespaces other than init don't get a sysfs entry.

For those in the init namespace, while we're waiting to remove
the sysfs entry for the uid the uid is still hashed, and
alloc_uid() may re-grab that uid without getting a new
reference to the user_ns, which we've already put in free_user
before scheduling remove_user_sysfs_dir().

Reported-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Acked-by: David Howells <dhowells@redhat.com>
Tested-by: Ingo Molnar <mingo@elte.hu>
---

 kernel/user.c |    3 +--
 1 files changed, 1 insertions(+), 2 deletions(-)


diff --git a/kernel/user.c b/kernel/user.c
index 477b666..3551ac7 100644
--- a/kernel/user.c
+++ b/kernel/user.c
@@ -72,6 +72,7 @@ static void uid_hash_insert(struct user_struct *up, struct hlist_head *hashent)
 static void uid_hash_remove(struct user_struct *up)
 {
 	hlist_del_init(&up->uidhash_node);
+	put_user_ns(up->user_ns);
 }
 
 static struct user_struct *uid_hash_find(uid_t uid, struct hlist_head *hashent)
@@ -334,7 +335,6 @@ static void free_user(struct user_struct *up, unsigned long flags)
 	atomic_inc(&up->__count);
 	spin_unlock_irqrestore(&uidhash_lock, flags);
 
-	put_user_ns(up->user_ns);
 	INIT_WORK(&up->work, remove_user_sysfs_dir);
 	schedule_work(&up->work);
 }
@@ -357,7 +357,6 @@ static void free_user(struct user_struct *up, unsigned long flags)
 	sched_destroy_user(up);
 	key_put(up->uid_keyring);
 	key_put(up->session_keyring);
-	put_user_ns(up->user_ns);
 	kmem_cache_free(uid_cachep, up);
 }
 

Re: [PATCH] User namespaces: Only put the userns when we unhash the uid

[Ingo Molnar]

* David Howells <dhowells-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org> wrote:

> From: Serge E. Hallyn <serue-r/Jw6+rmf7HQT0dZR+AlfA@public.gmane.org>
> 
> uids in namespaces other than init don't get a sysfs entry.
> 
> For those in the init namespace, while we're waiting to remove
> the sysfs entry for the uid the uid is still hashed, and
> alloc_uid() may re-grab that uid without getting a new
> reference to the user_ns, which we've already put in free_user
> before scheduling remove_user_sysfs_dir().
> 
> Reported-by: KOSAKI Motohiro <kosaki.motohiro-+CUm20s59erQFUHtdCDX3A@public.gmane.org>
> Signed-off-by: Serge E. Hallyn <serue-r/Jw6+rmf7HQT0dZR+AlfA@public.gmane.org>
> Acked-by: David Howells <dhowells-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
> Tested-by: Ingo Molnar <mingo-X9Un+BFzKDI@public.gmane.org>

beyond the crashes, this should resolve this slab corruption
regression too:

Bug-Entry       : http://bugzilla.kernel.org/show_bug.cgi?id=12503
Subject         : [slab corruption] BUG key_jar: Poison overwritten
Submitter       : Ingo Molnar <mingo-X9Un+BFzKDI@public.gmane.org>
Date            : 2009-01-15 18:16 (25 days old)
References      : http://marc.info/?l=linux-kernel&m=123204353425825&w=4
Handled-By      : David Howells <dhowells-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>

	Ingo

Re: [PATCH] User namespaces: Only put the userns when we unhash the uid

[KOSAKI Motohiro]

> From: Serge E. Hallyn <serue@us.ibm.com>
>
> uids in namespaces other than init don't get a sysfs entry.
>
> For those in the init namespace, while we're waiting to remove
> the sysfs entry for the uid the uid is still hashed, and
> alloc_uid() may re-grab that uid without getting a new
> reference to the user_ns, which we've already put in free_user
> before scheduling remove_user_sysfs_dir().
>
> Reported-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
> Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
> Acked-by: David Howells <dhowells@redhat.com>
> Tested-by: Ingo Molnar <mingo@elte.hu>

ok, thanks good patch.
  Tested-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>