Messages in this thread | | | Date | Thu, 23 Dec 2010 19:55:23 -0800 | From | Greg KH <> | Subject | Re: [PATCH] fix freeing user_struct in user cache |
| |
On Thu, Dec 23, 2010 at 08:52:34PM +0800, Hillf Danton wrote: > When racing on adding into user cache, the new allocated from mm slab > is freed without putting user namespace. > > Since the user namespace is already operated by getting, putting has > to be issued. > > btw, it could be freed out of lock? > > Signed-off-by: Hillf Danton <dhillf@gmail.com> > --- > > --- a/kernel/user.c 2010-11-01 19:54:12.000000000 +0800 > +++ b/kernel/user.c 2010-12-23 20:42:00.000000000 +0800 > @@ -158,6 +158,7 @@ struct user_struct *alloc_uid(struct use > spin_lock_irq(&uidhash_lock); > up = uid_hash_find(uid, hashent); > if (up) { > + put_user_ns(ns); > key_put(new->uid_keyring); > key_put(new->session_keyring); > kmem_cache_free(uid_cachep, new);
Hm, are you sure about this? Also, why send this to me, did I last touch this?
confused,
greg k-h
| |