Re: namespaces?: bug at mm/slub.c:2750

[Serge E. Hallyn]

Quoting David Howells (dhowells@xxxxxxxxxx):
> Serge E. Hallyn <serue@xxxxxxxxxx> wrote:
> 
> > Yes, but noone will pull the user_struct off the list without
> > taking the lock.
> > 
> > what am I missing?
> 
> I believe that the hash link (uidhash_node) in the user_struct that is passed
> to uid_hash_remove() points to, and is pointed to by the user_namespace to
> which the user_struct belongs.
> 
> In which case calling put_user_ns() may kfree the head pointer of the list
> _before_ hlist_del_init() is invoked - in which case hlist_del_init() will act
> upon freed memory.
> 
> At least, I think it works like this.

Yikes, you're right.  I was thinking there was on hash table with
the key calculated from ns+uid, but instead each ns has its own
hash table keyed on uid.

> Anyway, I have no objection to your new patch.
> 
> Acked-by: David Howells <dhowells@xxxxxxxxxx>

thanks,
-serge
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/