Re: linux 5.14.3: free_user_ns causes NULL pointer dereference

Eric W. Biederman
2021-10-12T17:31:11Z

Rune Kleveland <rune.kleveland@infomedia.dk> writes:

> Hi!
>
> Just wanted to let you know that I still get these on stock Fedora kernel
> 5.14.10 on the IBM blades. But it took 10 hours before the first server
> crashed. The other 4 still runs fine since 15 hours ago. So for me it seems more
> stable now, but that could just be a coincidence.

Alex and I have been working on this and we are still tracking down
whatever is going on.

While we haven't found the issue yet we have found a trivially correct
change that allows us to reproduce the issue faster.

Hopefully this will allow us to narrow down on whatever it is soon.

diff --git a/kernel/ucount.c b/kernel/ucount.c
index bb51849e6375..3b7e176cf7a2 100644
--- a/kernel/ucount.c
+++ b/kernel/ucount.c
@@ -203,6 +203,7 @@ void put_ucounts(struct ucounts *ucounts)

if (atomic_dec_and_lock_irqsave(&ucounts->count, &ucounts_lock, flags)) {
hlist_del_init(&ucounts->node);
+ ucounts->ns = NULL;
spin_unlock_irqrestore(&ucounts_lock, flags);
kfree(ucounts);
}

Eric