Re: linux 5.14.3: free_user_ns causes NULL pointer dereference

[Eric W. Biederman]

Rune Kleveland <rune.kleveland@xxxxxxxxxxxx> writes:

> Hi!
>
> Just wanted to let you know that I still get these on stock Fedora kernel
> 5.14.10 on the IBM blades. But it took 10 hours before the first server
> crashed. The other 4 still runs fine since 15 hours ago. So for me it seems more
> stable now, but that could just be a coincidence.

Alex and I have been working on this and we are still tracking down
whatever is going on.

While we haven't found the issue yet we have found a trivially correct
change that allows us to reproduce the issue faster.

Hopefully this will allow us to narrow down on whatever it is soon.

diff --git a/kernel/ucount.c b/kernel/ucount.c
index bb51849e6375..3b7e176cf7a2 100644
--- a/kernel/ucount.c
+++ b/kernel/ucount.c
@@ -203,6 +203,7 @@ void put_ucounts(struct ucounts *ucounts)
 
 	if (atomic_dec_and_lock_irqsave(&ucounts->count, &ucounts_lock, flags)) {
 		hlist_del_init(&ucounts->node);
+		ucounts->ns = NULL;
 		spin_unlock_irqrestore(&ucounts_lock, flags);
 		kfree(ucounts);
 	}

Eric