From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752826AbbJOMly (ORCPT ); Thu, 15 Oct 2015 08:41:54 -0400 Received: from mailout2.w1.samsung.com ([210.118.77.12]:41360 "EHLO mailout2.w1.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752355AbbJOMlw (ORCPT ); Thu, 15 Oct 2015 08:41:52 -0400 X-AuditID: cbfec7f4-f79c56d0000012ee-8a-561f9f0b6fc3 Message-id: <1444912906.5661.7.camel@samsung.com> Subject: Re: [PATCH v4 09/11] smack: namespace groundwork From: Lukasz Pawelczyk To: Hillf Danton Cc: Andy Lutomirski , Kees Cook , linux-kernel , linux-security-module@vger.kernel.org Date: Thu, 15 Oct 2015 14:41:46 +0200 In-reply-to: <01a101d1071c$8ce631b0$a6b29510$@alibaba-inc.com> References: <019801d1071b$2c124000$8436c000$@alibaba-inc.com> <01a101d1071c$8ce631b0$a6b29510$@alibaba-inc.com> Content-type: text/plain; charset=UTF-8 X-Mailer: Evolution 3.16.5 (3.16.5-3.fc22) MIME-version: 1.0 Content-transfer-encoding: 7bit X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFjrDLMWRmVeSWpSXmKPExsVy+t/xq7rc8+XDDLrnsFjMnX+Y3eJMd67F 5V1z2Cw+9Dxis1i9toHVgdVj4tuPLB733/xl8ZjdcJHF4/MmuQCWKC6blNSczLLUIn27BK6M 1+sXshW846iYu/UzSwNjP3sXIyeHhICJxK3lj1kgbDGJC/fWs3UxcnEICSxllJhyaSsThPOZ UWLvnq+sIFW8AoYSTz7cBusWFrCUuL3vAhuIzSZgIPH9wl5mEFtEQFvi1Zc/jCDNzAJLGCUu rfzHCJJgEVCVeDXzF9BUDg5OATuJtiOqIGEhgUKJad07wOYwC6hLTJq3iBniIi2Jg8+fMkHs FZT4MfkeC0SNvMTmNW+ZJzAKzELSMgtJ2SwkZQsYmVcxiqaWJhcUJ6XnGuoVJ+YWl+al6yXn 525ihITxlx2Mi49ZHWIU4GBU4uE98UAuTIg1say4MvcQowQHs5IIb1+VfJgQb0piZVVqUX58 UWlOavEhRmkOFiVx3rm73ocICaQnlqRmp6YWpBbBZJk4OKUaGHU//53QtWKPUGfMb3W/R8r/ xGQO+6yqWXWBOb3G+Yf/Q9XkRk7PziU3Uw9PO9RS8OGO63+W6HdZYttmJvh01FsrV17YP2Nt QU8Cl03wrp9ql/qfeTya7WC1NPSdVunHxnDh/DMzWx8dOlDOfzpU9oBcR0A3U2zkvBmxn5JX aK/g1zs2RSlEWomlOCPRUIu5qDgRAFPWM+VfAgAA Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On czw, 2015-10-15 at 15:38 +0800, Hillf Danton wrote: > > > > +static inline void smack_userns_free(struct user_namespace *ns) > > +{ > > + struct smack_ns *snsp = ns->security; > > + struct smack_known *skp; > > + struct smack_known_ns *sknp, *n; > > + > > + list_for_each_entry_safe(sknp, n, &snsp->smk_mapped, > > smk_list_ns) { > > + skp = sknp->smk_unmapped; > > + > > + mutex_lock(&skp->smk_mapped_lock); > > + list_del_rcu(&sknp->smk_list_known); > > + if (sknp->smk_allocated) > > + kfree(sknp->smk_mapped); > > + kfree(sknp); > > sknp is released, > > + mutex_unlock(&skp->smk_mapped_lock); > > + > > + list_del(&sknp->smk_list_ns); > > but it is used again! typo? No, not a typo. A regular bug. Thanks for spotting it. Also sync mechanism before freeing was missing: skp = sknp->smk_unmapped; mutex_lock(&skp->smk_mapped_lock); list_del_rcu(&sknp->smk_list_known); mutex_unlock(&skp->smk_mapped_lock); list_del(&sknp->smk_list_ns); call_rcu(&sknp->smk_rcu, smk_free_known_ns); -- Lukasz Pawelczyk Samsung R&D Institute Poland Samsung Electronics