• Pavel Emelyanov's avatar
    Fix user namespace exiting OOPs · 28f300d2
    Pavel Emelyanov authored
    It turned out, that the user namespace is released during the do_exit() in
    exit_task_namespaces(), but the struct user_struct is released only during the
    put_task_struct(), i.e.  MUCH later.
    
    On debug kernels with poisoned slabs this will cause the oops in
    uid_hash_remove() because the head of the chain, which resides inside the
    struct user_namespace, will be already freed and poisoned.
    
    Since the uid hash itself is required only when someone can search it, i.e.
    when the namespace is alive, we can safely unhash all the user_struct-s from
    it during the namespace exiting.  The subsequent free_uid() will complete the
    user_struct destruction.
    
    For example simple program
    
       #include <sched.h>
    
       char stack[2 * 1024 * 1024];
    
       int f(void *foo)
       {
       	return 0;
       }
    
       int main(void)
       {
       	clone(f, stack + 1 * 1024 * 1024, 0x10000000, 0);
       	return 0;
       }
    
    run on kernel with CONFIG_USER_NS turned on will oops the
    kernel immediately.
    
    This was spotted during OpenVZ kernel testing.
    Signed-off-by: default avatarPavel Emelyanov <xemul@openvz.org>
    Signed-off-by: default avatarAlexey Dobriyan <adobriyan@openvz.org>
    Acked-by: default avatar"Serge E. Hallyn" <serue@us.ibm.com>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    28f300d2
user.c 5.95 KB