From: David Howells <dhowells@redhat.com>
To: "Serge E. Hallyn" <serue@us.ibm.com>
Cc: dhowells@redhat.com, Vegard Nossum <vegard.nossum@gmail.com>,
Andrew Morton <akpm@linux-foundation.org>,
Eric Sesterhenn <snakebyte@gmx.de>,
containers@lists.osdl.org, linux-kernel@vger.kernel.org,
Dhaval Giani <dhaval@linux.vnet.ibm.com>,
Peter Zijlstra <a.p.zijlstra@chello.nl>
Subject: Re: namespaces?: bug at mm/slub.c:2750
Date: Wed, 11 Feb 2009 20:42:41 +0000 [thread overview]
Message-ID: <6369.1234384961@redhat.com> (raw)
In-Reply-To: <20090211193846.GB1344@us.ibm.com>
Serge E. Hallyn <serue@us.ibm.com> wrote:
> Yes, but noone will pull the user_struct off the list without
> taking the lock.
>
> what am I missing?
I believe that the hash link (uidhash_node) in the user_struct that is passed
to uid_hash_remove() points to, and is pointed to by the user_namespace to
which the user_struct belongs.
In which case calling put_user_ns() may kfree the head pointer of the list
_before_ hlist_del_init() is invoked - in which case hlist_del_init() will act
upon freed memory.
At least, I think it works like this.
Anyway, I have no objection to your new patch.
Acked-by: David Howells <dhowells@redhat.com>
next prev parent reply other threads:[~2009-02-11 20:44 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-02-06 11:35 namespaces?: bug at mm/slub.c:2750 Eric Sesterhenn
2009-02-07 0:15 ` Andrew Morton
2009-02-09 11:53 ` Eric Sesterhenn
2009-02-11 7:55 ` Vegard Nossum
2009-02-11 8:07 ` Andrew Morton
2009-02-11 10:48 ` Vegard Nossum
2009-02-11 16:37 ` Serge E. Hallyn
2009-02-11 17:02 ` David Howells
2009-02-11 17:24 ` Serge E. Hallyn
2009-02-11 18:00 ` Vegard Nossum
2009-02-11 18:03 ` David Howells
2009-02-11 19:38 ` Serge E. Hallyn
2009-02-11 20:42 ` David Howells [this message]
2009-02-11 21:21 ` Serge E. Hallyn
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6369.1234384961@redhat.com \
--to=dhowells@redhat.com \
--cc=a.p.zijlstra@chello.nl \
--cc=akpm@linux-foundation.org \
--cc=containers@lists.osdl.org \
--cc=dhaval@linux.vnet.ibm.com \
--cc=linux-kernel@vger.kernel.org \
--cc=serue@us.ibm.com \
--cc=snakebyte@gmx.de \
--cc=vegard.nossum@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox