Messages in this thread | | | Date | Wed, 14 Mar 2012 21:37:46 +0000 | From | Al Viro <> | Subject | Re: [PATCH] vfs namespace: Don't assume mount namespace has valid root |
| |
On Wed, Mar 14, 2012 at 11:03:43PM +0200, Sasha Levin wrote: > > And that's all pointers to mnt_namespace that ever exist, aside of function > > arguments and local variables. ?I'm not saying that I couldn't have possibly > > fucked it up, but from rereading that code it doesn't look like we could > > end up with dangling pointers to already freed instances... > > I'm trying to find the exact chain of events leading it it at the > moment, but it reproduces rather easily - so if you have any ideas on > figuring it out I'm happy to try anything.
Which kernel, for starters? I'd probably add dumping call chain + return value in alloc_mnt_ns(), call chain + pointer being freed in final put_mnt_ns() and failure exit of dup_mnt_ns(), address of mnt_ns and value assigned to ->root on assignments to ->root in create_mnt_ns() and dup_mnt_ns() and mnt_ns in dup_mnt_ns() if it happens to have NULL ->root.
That should give you full history of allocation/freeing mnt_namespace instances and of assignments to anyone's ->root. Ought to make a sane starting point...
| |