From 7a238fcba0629b6f2edbcd37458bae56fcf36be5 Mon Sep 17 00:00:00 2001 From: "Serge E. Hallyn" Date: Mon, 29 Jan 2007 13:19:40 -0800 Subject: [PATCH] namespaces: fix exit race by splitting exit Fix exit race by splitting the nsproxy putting into two pieces. First piece reduces the nsproxy refcount. If we dropped the last reference, then it puts the mnt_ns, and returns the nsproxy as a hint to the caller. Else it returns NULL. The second piece of exiting task namespaces sets tsk->nsproxy to NULL, and drops the references to other namespaces and frees the nsproxy only if an nsproxy was passed in. A little awkward and should probably be reworked, but hopefully it fixes the NFS oops. Signed-off-by: Serge E. Hallyn Cc: Herbert Poetzl Cc: Oleg Nesterov Cc: "Eric W. Biederman" Cc: Cedric Le Goater Cc: Daniel Hokka Zakrisson Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- kernel/exit.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'kernel/exit.c') diff --git a/kernel/exit.c b/kernel/exit.c index 35401720635..a5bf5329ff9 100644 --- a/kernel/exit.c +++ b/kernel/exit.c @@ -396,7 +396,7 @@ void daemonize(const char *name, ...) current->fs = fs; atomic_inc(&fs->count); - exit_task_namespaces(current); + put_and_finalize_nsproxy(current->nsproxy); current->nsproxy = init_task.nsproxy; get_task_namespaces(current); @@ -853,6 +853,7 @@ static void exit_notify(struct task_struct *tsk) fastcall NORET_TYPE void do_exit(long code) { struct task_struct *tsk = current; + struct nsproxy *ns; int group_dead; profile_task_exit(tsk); @@ -938,8 +939,9 @@ fastcall NORET_TYPE void do_exit(long code) tsk->exit_code = code; proc_exit_connector(tsk); + ns = preexit_task_namespaces(tsk); exit_notify(tsk); - exit_task_namespaces(tsk); + exit_task_namespaces(tsk, ns); #ifdef CONFIG_NUMA mpol_free(tsk->mempolicy); tsk->mempolicy = NULL; -- cgit v1.2.3 From 444f378b237a0f728f5c4aba752c08d13c209344 Mon Sep 17 00:00:00 2001 From: Linus Torvalds Date: Tue, 30 Jan 2007 13:35:18 -0800 Subject: Revert "[PATCH] namespaces: fix exit race by splitting exit" This reverts commit 7a238fcba0629b6f2edbcd37458bae56fcf36be5 in preparation for a better and simpler fix proposed by Eric Biederman (and fixed up by Serge Hallyn) Acked-by: Serge E. Hallyn Signed-off-by: Linus Torvalds --- kernel/exit.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) (limited to 'kernel/exit.c') diff --git a/kernel/exit.c b/kernel/exit.c index a5bf5329ff9..35401720635 100644 --- a/kernel/exit.c +++ b/kernel/exit.c @@ -396,7 +396,7 @@ void daemonize(const char *name, ...) current->fs = fs; atomic_inc(&fs->count); - put_and_finalize_nsproxy(current->nsproxy); + exit_task_namespaces(current); current->nsproxy = init_task.nsproxy; get_task_namespaces(current); @@ -853,7 +853,6 @@ static void exit_notify(struct task_struct *tsk) fastcall NORET_TYPE void do_exit(long code) { struct task_struct *tsk = current; - struct nsproxy *ns; int group_dead; profile_task_exit(tsk); @@ -939,9 +938,8 @@ fastcall NORET_TYPE void do_exit(long code) tsk->exit_code = code; proc_exit_connector(tsk); - ns = preexit_task_namespaces(tsk); exit_notify(tsk); - exit_task_namespaces(tsk, ns); + exit_task_namespaces(tsk); #ifdef CONFIG_NUMA mpol_free(tsk->mempolicy); tsk->mempolicy = NULL; -- cgit v1.2.3 From 0f2452855d86901ba3766826ccb5606ea4e15ab9 Mon Sep 17 00:00:00 2001 From: "Serge E. Hallyn" Date: Tue, 30 Jan 2007 15:28:23 -0600 Subject: [PATCH] namespaces: fix task exit disaster This is based on a patch by Eric W. Biederman, who pointed out that pid namespaces are still fake, and we only have one ever active. So for the time being, we can modify any code which could access tsk->nsproxy->pid_ns during task exit to just use &init_pid_ns instead, and move the exit_task_namespaces call in do_exit() back above exit_notify(), so that an exiting nfs server has a valid tsk->sighand to work with. Long term, pulling pid_ns out of nsproxy might be the cleanest solution. Signed-off-by: Eric W. Biederman [ Eric's patch fixed to take care of free_pid() too ] Signed-off-by: Serge E. Hallyn Signed-off-by: Linus Torvalds --- kernel/exit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'kernel/exit.c') diff --git a/kernel/exit.c b/kernel/exit.c index 35401720635..fec12eb1247 100644 --- a/kernel/exit.c +++ b/kernel/exit.c @@ -938,8 +938,8 @@ fastcall NORET_TYPE void do_exit(long code) tsk->exit_code = code; proc_exit_connector(tsk); - exit_notify(tsk); exit_task_namespaces(tsk); + exit_notify(tsk); #ifdef CONFIG_NUMA mpol_free(tsk->mempolicy); tsk->mempolicy = NULL; -- cgit v1.2.3