Messages in this thread | | | Date | Wed, 11 Feb 2009 11:24:16 -0600 | From | "Serge E. Hallyn" <> | Subject | Re: namespaces?: bug at mm/slub.c:2750 |
| |
Quoting David Howells (dhowells@redhat.com): > Serge E. Hallyn <serue@us.ibm.com> wrote: > > > static void uid_hash_remove(struct user_struct *up) > > { > > + put_user_ns(up->user_ns); > > hlist_del_init(&up->uidhash_node); > > } > > Don't you need to do the hlist_del_init() first? Otherwise, mightn't the > put_user_ns() cause the namespace to be freed before hlist_del_init() removes > the user_struct from it?
It's called under uidhash_lock spinlock so should be ok, but in principle you're right so it's probably a good idea.
The main point is that without this patch, put_user_ns is done before the hlist_del_init and *not* atomically under uidhash_lock.
thanks, -serge
| |