From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5F033C433EF for ; Wed, 29 Sep 2021 17:36:18 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id CF1876147F for ; Wed, 29 Sep 2021 17:36:17 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org CF1876147F Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=kernel.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kvack.org Received: by kanga.kvack.org (Postfix) id 4571A94004A; Wed, 29 Sep 2021 13:36:17 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 4069094003A; Wed, 29 Sep 2021 13:36:17 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 2CDB794004A; Wed, 29 Sep 2021 13:36:17 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0079.hostedemail.com [216.40.44.79]) by kanga.kvack.org (Postfix) with ESMTP id 1AA2294003A for ; Wed, 29 Sep 2021 13:36:17 -0400 (EDT) Received: from smtpin10.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay02.hostedemail.com (Postfix) with ESMTP id C1A992DEAF for ; Wed, 29 Sep 2021 17:36:16 +0000 (UTC) X-FDA: 78641314752.10.02610AE Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by imf08.hostedemail.com (Postfix) with ESMTP id 6551830000BD for ; Wed, 29 Sep 2021 17:36:16 +0000 (UTC) Received: by mail.kernel.org (Postfix) with ESMTPSA id 3BE7C61425; Wed, 29 Sep 2021 17:36:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1632936975; bh=j1CsznRTMXpjsShtriwNxPC6pmRqXDzujQrZsSfAeM8=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=raZU/HDY5k5IUjQfPl0oibiW+mRVehapURJDZjKDx73YawoM+fgRBSrK1uAYWxJ0i IAHX2BVJNrOeGd/X91LQcf/E0c2CrL5URKptUUZivm/TLAA4xCR7lTCVSsPUfzL57D RsVF89GQfHzg5rB7/XQPF7jrxKIs690Jj5mMhERivRxVhYuLEl3qQhqelHLtZAYkdW Rtuecv3oR1Y53pRMEmTpf+8XvQxVgbngc23NtWv06Fw/B7XppGiyo7reG4wE75BC46 siMxvMJFdUl9fefBXwEK9THRNemZiGHGMEyrv6EuJ0a1xRH9z/YBVR5Si4wC0IHvDe oyRbpTmbIMc1A== Date: Wed, 29 Sep 2021 19:36:11 +0200 From: Alexey Gladkov To: Jordan Glover Cc: ebiederm@xmission.com, LKML , "linux-mm\\@kvack.org" , "containers\\@lists.linux-foundation.org" , Yu Zhao Subject: Re: linux 5.14.3: free_user_ns causes NULL pointer dereference Message-ID: <20210929173611.fo5traia77o63gpw@example.org> References: <1M9_d6wrcu6rdPe1ON0_k0lOxJMyyot3KAb1gdyuwzDPC777XVUWPHoTCEVmcK3fYfgu7sIo3PSaLe9KulUdm4TWVuqlbKyYGxRAjsf_Cpk=@protonmail.ch> <87ee9pa6xw.fsf@disp2133> <878rzw77i3.fsf@disp2133> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Rspamd-Queue-Id: 6551830000BD X-Stat-Signature: ipxh5yrk558uffiqatwjasftnypsmisa Authentication-Results: imf08.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b="raZU/HDY"; spf=pass (imf08.hostedemail.com: domain of legion@kernel.org designates 198.145.29.99 as permitted sender) smtp.mailfrom=legion@kernel.org; dmarc=pass (policy=none) header.from=kernel.org X-Rspamd-Server: rspam06 X-HE-Tag: 1632936976-11388 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Tue, Sep 28, 2021 at 01:40:48PM +0000, Jordan Glover wrote: > On Thursday, September 16th, 2021 at 5:30 PM, wrote: > > > Jordan Glover Golden_Miller83@protonmail.ch writes: > > > > > On Wednesday, September 15th, 2021 at 10:42 PM, Jordan Glover Golden_Miller83@protonmail.ch wrote: > > > > > > > I had about 2 containerized (flatpak/bubblewrap) apps (browser + music player) running . I quickly closed them with intent to shutdown the system but instead get the freeze and had to use magic sysrq to reboot. System logs end with what I posted and before there is nothing suspicious. > > > > > > > > Maybe it's some random fluke. I'll reply if I hit it again. > > > > > > Heh, it jut happened again. This time closing firefox alone had such > > > effect: > > > > Ok. It looks like he have a couple of folks seeing issues here. > > I thought we had all of the issues sorted out for the release of v5.14, > > but it looks like there is still some little bug left. > > > > If Alex doesn't beat me to it I will see if I can come up with a > > debugging patch to make it easy to help track down where the reference > > count is going wrong. It will be a little bit as my brain is mush at > > the moment. > > > > Eric > > As the issue persist in 5.14.7 I would be very interested in such patch. > > For now the thing is mostly reproducible when I close several tabs in ff then > close the browser in short period of time. When I close tabs then wait out > a bit then close the browser it doesn't happen so I guess some interrupted > cleanup triggers it. I'm still investigating, but I would like to rule out one option. Could you check out the patch? diff --git a/kernel/ucount.c b/kernel/ucount.c index bb51849e6375..f23f906f4f62 100644 --- a/kernel/ucount.c +++ b/kernel/ucount.c @@ -201,11 +201,14 @@ void put_ucounts(struct ucounts *ucounts) { unsigned long flags; - if (atomic_dec_and_lock_irqsave(&ucounts->count, &ucounts_lock, flags)) { + spin_lock_irqsave(&ucounts_lock, flags); + if (atomic_dec_and_test(&ucounts->count)) { hlist_del_init(&ucounts->node); spin_unlock_irqrestore(&ucounts_lock, flags); kfree(ucounts); + return; } + spin_unlock_irqrestore(&ucounts_lock, flags); } static inline bool atomic_long_inc_below(atomic_long_t *v, int u) -- Rgrds, legion