Commit 7a238fcb authored by Serge E. Hallyn's avatar Serge E. Hallyn Committed by Linus Torvalds

[PATCH] namespaces: fix exit race by splitting exit

Fix exit race by splitting the nsproxy putting into two pieces.  First
piece reduces the nsproxy refcount.  If we dropped the last reference, then
it puts the mnt_ns, and returns the nsproxy as a hint to the caller.  Else
it returns NULL.  The second piece of exiting task namespaces sets
tsk->nsproxy to NULL, and drops the references to other namespaces and
frees the nsproxy only if an nsproxy was passed in.

A little awkward and should probably be reworked, but hopefully it fixes
the NFS oops.
Signed-off-by: default avatarSerge E. Hallyn <serue@us.ibm.com>
Cc: Herbert Poetzl <herbert@13thfloor.at>
Cc: Oleg Nesterov <oleg@tv-sign.ru>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Cedric Le Goater <clg@fr.ibm.com>
Cc: Daniel Hokka Zakrisson <daniel@hozac.com>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent c0d4d573
...@@ -35,22 +35,30 @@ struct nsproxy *dup_namespaces(struct nsproxy *orig); ...@@ -35,22 +35,30 @@ struct nsproxy *dup_namespaces(struct nsproxy *orig);
int copy_namespaces(int flags, struct task_struct *tsk); int copy_namespaces(int flags, struct task_struct *tsk);
void get_task_namespaces(struct task_struct *tsk); void get_task_namespaces(struct task_struct *tsk);
void free_nsproxy(struct nsproxy *ns); void free_nsproxy(struct nsproxy *ns);
struct nsproxy *put_nsproxy(struct nsproxy *ns);
static inline void put_nsproxy(struct nsproxy *ns) static inline void finalize_put_nsproxy(struct nsproxy *ns)
{ {
if (atomic_dec_and_test(&ns->count)) { if (ns)
free_nsproxy(ns); free_nsproxy(ns);
}
} }
static inline void exit_task_namespaces(struct task_struct *p) static inline void put_and_finalize_nsproxy(struct nsproxy *ns)
{ {
struct nsproxy *ns = p->nsproxy; finalize_put_nsproxy(put_nsproxy(ns));
if (ns) { }
task_lock(p);
p->nsproxy = NULL; static inline struct nsproxy *preexit_task_namespaces(struct task_struct *p)
task_unlock(p); {
put_nsproxy(ns); return put_nsproxy(p->nsproxy);
} }
static inline void exit_task_namespaces(struct task_struct *p,
struct nsproxy *ns)
{
task_lock(p);
p->nsproxy = NULL;
task_unlock(p);
finalize_put_nsproxy(ns);
} }
#endif #endif
...@@ -396,7 +396,7 @@ void daemonize(const char *name, ...) ...@@ -396,7 +396,7 @@ void daemonize(const char *name, ...)
current->fs = fs; current->fs = fs;
atomic_inc(&fs->count); atomic_inc(&fs->count);
exit_task_namespaces(current); put_and_finalize_nsproxy(current->nsproxy);
current->nsproxy = init_task.nsproxy; current->nsproxy = init_task.nsproxy;
get_task_namespaces(current); get_task_namespaces(current);
...@@ -853,6 +853,7 @@ static void exit_notify(struct task_struct *tsk) ...@@ -853,6 +853,7 @@ static void exit_notify(struct task_struct *tsk)
fastcall NORET_TYPE void do_exit(long code) fastcall NORET_TYPE void do_exit(long code)
{ {
struct task_struct *tsk = current; struct task_struct *tsk = current;
struct nsproxy *ns;
int group_dead; int group_dead;
profile_task_exit(tsk); profile_task_exit(tsk);
...@@ -938,8 +939,9 @@ fastcall NORET_TYPE void do_exit(long code) ...@@ -938,8 +939,9 @@ fastcall NORET_TYPE void do_exit(long code)
tsk->exit_code = code; tsk->exit_code = code;
proc_exit_connector(tsk); proc_exit_connector(tsk);
ns = preexit_task_namespaces(tsk);
exit_notify(tsk); exit_notify(tsk);
exit_task_namespaces(tsk); exit_task_namespaces(tsk, ns);
#ifdef CONFIG_NUMA #ifdef CONFIG_NUMA
mpol_free(tsk->mempolicy); mpol_free(tsk->mempolicy);
tsk->mempolicy = NULL; tsk->mempolicy = NULL;
......
...@@ -1265,7 +1265,7 @@ static struct task_struct *copy_process(unsigned long clone_flags, ...@@ -1265,7 +1265,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
return p; return p;
bad_fork_cleanup_namespaces: bad_fork_cleanup_namespaces:
exit_task_namespaces(p); put_and_finalize_nsproxy(p->nsproxy);
bad_fork_cleanup_keys: bad_fork_cleanup_keys:
exit_keys(p); exit_keys(p);
bad_fork_cleanup_mm: bad_fork_cleanup_mm:
...@@ -1711,7 +1711,7 @@ asmlinkage long sys_unshare(unsigned long unshare_flags) ...@@ -1711,7 +1711,7 @@ asmlinkage long sys_unshare(unsigned long unshare_flags)
} }
if (new_nsproxy) if (new_nsproxy)
put_nsproxy(new_nsproxy); put_and_finalize_nsproxy(new_nsproxy);
bad_unshare_cleanup_ipc: bad_unshare_cleanup_ipc:
if (new_ipc) if (new_ipc)
......
...@@ -117,7 +117,7 @@ int copy_namespaces(int flags, struct task_struct *tsk) ...@@ -117,7 +117,7 @@ int copy_namespaces(int flags, struct task_struct *tsk)
goto out_pid; goto out_pid;
out: out:
put_nsproxy(old_ns); put_and_finalize_nsproxy(old_ns);
return err; return err;
out_pid: out_pid:
...@@ -135,6 +135,20 @@ out_ns: ...@@ -135,6 +135,20 @@ out_ns:
goto out; goto out;
} }
struct nsproxy *put_nsproxy(struct nsproxy *ns)
{
if (ns) {
if (atomic_dec_and_test(&ns->count)) {
if (ns->mnt_ns) {
put_mnt_ns(ns->mnt_ns);
ns->mnt_ns = NULL;
}
return ns;
}
}
return NULL;
}
void free_nsproxy(struct nsproxy *ns) void free_nsproxy(struct nsproxy *ns)
{ {
if (ns->mnt_ns) if (ns->mnt_ns)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment