Messages in this thread | | | Date | Thu, 2 Jul 2009 11:37:31 -0500 | From | "Serge E. Hallyn" <> | Subject | Re: [PATCH][BUGFIX] cgroups: fix pid namespace bug |
| |
Quoting Paul Menage (menage@google.com): > On Wed, Jul 1, 2009 at 6:24 PM, Li Zefan<lizf@cn.fujitsu.com> wrote: > > + cp = kzalloc(sizeof(*cp), GFP_KERNEL); > > + if (!cp) { > > + up_write(&cgrp->pids_mutex); > > + kfree(pidarray); > > + return -ENOMEM; > > + } > > + cp->cgrp = cgrp; > > + cp->pid_ns = pid_ns; > > You're storing an uncounted reference to the pid ns here - there's no > guarantee that the pid_ns will outlive the open file.
Yeah I was thinking about that, but
1. the only way it won't outlive the open file is if the task opens the file, hands the open fd over a unix socket, then exits as the last task of its pidns 2. We don't dereference the pid_ns, so there is no actual safety issue. So it would become a problem only if a new pidns gets created at that same address *and* a task in the new pidns opens the same tasks file.
Still, it wouldn't hurt to do get_pid_ns/put_pid_ns at the open and release :)
-serge -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |