[lkml]   [2009]   [Feb]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    SubjectRe: namespaces?: bug at mm/slub.c:2750
    Quoting David Howells (
    > Serge E. Hallyn <> wrote:
    > > It's called under uidhash_lock spinlock so should be ok, but in
    > > principle you're right so it's probably a good idea.
    > The lock is nothing to do with it. put_user_ns() may call kfree() on the
    > user_namespace, but the user_struct given to uid_hash_remove() may still be
    > attached to it.

    Yes, but noone will pull the user_struct off the list without
    taking the lock.

    what am I missing?

    Anyway, I do like swapping the lines (as below) better.


    From 8b83d11023c1064e99bffae3c2a05580b915de60 Mon Sep 17 00:00:00 2001
    From: Serge E. Hallyn <>
    Date: Wed, 11 Feb 2009 11:29:52 -0500
    Subject: [PATCH 1/1] user namespaces: only put the userns when we unhash the uid

    uids in namespaces other than init don't get a sysfs entry.

    For those in the init namespace, while we're waiting to remove
    the sysfs entry for the uid the uid is still hashed, and
    alloc_uid() may re-grab that uid without getting a new
    reference to the user_ns, which we've already put in free_user
    before scheduling remove_user_sysfs_dir().

    Signed-off-by: Serge E. Hallyn <>
    kernel/user.c | 3 +--
    1 files changed, 1 insertions(+), 2 deletions(-)

    diff --git a/kernel/user.c b/kernel/user.c
    index 477b666..3551ac7 100644
    --- a/kernel/user.c
    +++ b/kernel/user.c
    @@ -72,6 +72,7 @@ static void uid_hash_insert(struct user_struct *up, struct hlist_head *hashent)
    static void uid_hash_remove(struct user_struct *up)
    + put_user_ns(up->user_ns);

    static struct user_struct *uid_hash_find(uid_t uid, struct hlist_head *hashent)
    @@ -334,7 +335,6 @@ static void free_user(struct user_struct *up, unsigned long flags)
    spin_unlock_irqrestore(&uidhash_lock, flags);

    - put_user_ns(up->user_ns);
    INIT_WORK(&up->work, remove_user_sysfs_dir);
    @@ -357,7 +357,6 @@ static void free_user(struct user_struct *up, unsigned long flags)
    - put_user_ns(up->user_ns);
    kmem_cache_free(uid_cachep, up);


     \ /
      Last update: 2009-02-11 20:41    [W:0.034 / U:69.664 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site