28f300d236
It turned out, that the user namespace is released during the do_exit() in
exit_task_namespaces(), but the struct user_struct is released only during the
put_task_struct(), i.e. MUCH later.
On debug kernels with poisoned slabs this will cause the oops in
uid_hash_remove() because the head of the chain, which resides inside the
struct user_namespace, will be already freed and poisoned.
Since the uid hash itself is required only when someone can search it, i.e.
when the namespace is alive, we can safely unhash all the user_struct-s from
it during the namespace exiting. The subsequent free_uid() will complete the
user_struct destruction.
For example simple program
#include <sched.h>
char stack[2 * 1024 * 1024];
int f(void *foo)
{
return 0;
}
int main(void)
{
clone(f, stack + 1 * 1024 * 1024, 0x10000000, 0);
return 0;
}
run on kernel with CONFIG_USER_NS turned on will oops the
kernel immediately.
This was spotted during OpenVZ kernel testing.
Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
Signed-off-by: Alexey Dobriyan <adobriyan@openvz.org>
Acked-by: "Serge E. Hallyn" <serue@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
89 lines
1.8 KiB
C
89 lines
1.8 KiB
C
/*
|
|
* This program is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU General Public License as
|
|
* published by the Free Software Foundation, version 2 of the
|
|
* License.
|
|
*/
|
|
|
|
#include <linux/module.h>
|
|
#include <linux/version.h>
|
|
#include <linux/nsproxy.h>
|
|
#include <linux/user_namespace.h>
|
|
|
|
struct user_namespace init_user_ns = {
|
|
.kref = {
|
|
.refcount = ATOMIC_INIT(2),
|
|
},
|
|
.root_user = &root_user,
|
|
};
|
|
|
|
EXPORT_SYMBOL_GPL(init_user_ns);
|
|
|
|
#ifdef CONFIG_USER_NS
|
|
|
|
/*
|
|
* Clone a new ns copying an original user ns, setting refcount to 1
|
|
* @old_ns: namespace to clone
|
|
* Return NULL on error (failure to kmalloc), new ns otherwise
|
|
*/
|
|
static struct user_namespace *clone_user_ns(struct user_namespace *old_ns)
|
|
{
|
|
struct user_namespace *ns;
|
|
struct user_struct *new_user;
|
|
int n;
|
|
|
|
ns = kmalloc(sizeof(struct user_namespace), GFP_KERNEL);
|
|
if (!ns)
|
|
return ERR_PTR(-ENOMEM);
|
|
|
|
kref_init(&ns->kref);
|
|
|
|
for (n = 0; n < UIDHASH_SZ; ++n)
|
|
INIT_HLIST_HEAD(ns->uidhash_table + n);
|
|
|
|
/* Insert new root user. */
|
|
ns->root_user = alloc_uid(ns, 0);
|
|
if (!ns->root_user) {
|
|
kfree(ns);
|
|
return ERR_PTR(-ENOMEM);
|
|
}
|
|
|
|
/* Reset current->user with a new one */
|
|
new_user = alloc_uid(ns, current->uid);
|
|
if (!new_user) {
|
|
free_uid(ns->root_user);
|
|
kfree(ns);
|
|
return ERR_PTR(-ENOMEM);
|
|
}
|
|
|
|
switch_uid(new_user);
|
|
return ns;
|
|
}
|
|
|
|
struct user_namespace * copy_user_ns(int flags, struct user_namespace *old_ns)
|
|
{
|
|
struct user_namespace *new_ns;
|
|
|
|
BUG_ON(!old_ns);
|
|
get_user_ns(old_ns);
|
|
|
|
if (!(flags & CLONE_NEWUSER))
|
|
return old_ns;
|
|
|
|
new_ns = clone_user_ns(old_ns);
|
|
|
|
put_user_ns(old_ns);
|
|
return new_ns;
|
|
}
|
|
|
|
void free_user_ns(struct kref *kref)
|
|
{
|
|
struct user_namespace *ns;
|
|
|
|
ns = container_of(kref, struct user_namespace, kref);
|
|
release_uids(ns);
|
|
kfree(ns);
|
|
}
|
|
|
|
#endif /* CONFIG_USER_NS */
|