diff options
| author | Serge E. Hallyn <serue@us.ibm.com> | 2007-01-29 13:19:40 -0800 |
|---|---|---|
| committer | Linus Torvalds <torvalds@woody.linux-foundation.org> | 2007-01-30 08:26:44 -0800 |
| commit | 7a238fcba0629b6f2edbcd37458bae56fcf36be5 (patch) | |
| tree | ad556f0ec00637df5b4c4a2063c6b3325666d2f1 /kernel | |
| parent | c0d4d573feed199b16094c072e7cb07afb01c598 (diff) | |
| download | op-kernel-dev-7a238fcba0629b6f2edbcd37458bae56fcf36be5.zip op-kernel-dev-7a238fcba0629b6f2edbcd37458bae56fcf36be5.tar.gz | |
[PATCH] namespaces: fix exit race by splitting exit
Fix exit race by splitting the nsproxy putting into two pieces. First
piece reduces the nsproxy refcount. If we dropped the last reference, then
it puts the mnt_ns, and returns the nsproxy as a hint to the caller. Else
it returns NULL. The second piece of exiting task namespaces sets
tsk->nsproxy to NULL, and drops the references to other namespaces and
frees the nsproxy only if an nsproxy was passed in.
A little awkward and should probably be reworked, but hopefully it fixes
the NFS oops.
Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Cc: Herbert Poetzl <herbert@13thfloor.at>
Cc: Oleg Nesterov <oleg@tv-sign.ru>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Cedric Le Goater <clg@fr.ibm.com>
Cc: Daniel Hokka Zakrisson <daniel@hozac.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/exit.c | 6 | ||||
| -rw-r--r-- | kernel/fork.c | 4 | ||||
| -rw-r--r-- | kernel/nsproxy.c | 16 |
3 files changed, 21 insertions, 5 deletions
diff --git a/kernel/exit.c b/kernel/exit.c index 3540172..a5bf532 100644 --- a/kernel/exit.c +++ b/kernel/exit.c @@ -396,7 +396,7 @@ void daemonize(const char *name, ...) current->fs = fs; atomic_inc(&fs->count); - exit_task_namespaces(current); + put_and_finalize_nsproxy(current->nsproxy); current->nsproxy = init_task.nsproxy; get_task_namespaces(current); @@ -853,6 +853,7 @@ static void exit_notify(struct task_struct *tsk) fastcall NORET_TYPE void do_exit(long code) { struct task_struct *tsk = current; + struct nsproxy *ns; int group_dead; profile_task_exit(tsk); @@ -938,8 +939,9 @@ fastcall NORET_TYPE void do_exit(long code) tsk->exit_code = code; proc_exit_connector(tsk); + ns = preexit_task_namespaces(tsk); exit_notify(tsk); - exit_task_namespaces(tsk); + exit_task_namespaces(tsk, ns); #ifdef CONFIG_NUMA mpol_free(tsk->mempolicy); tsk->mempolicy = NULL; diff --git a/kernel/fork.c b/kernel/fork.c index fc723e5..4cf8684 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -1265,7 +1265,7 @@ static struct task_struct *copy_process(unsigned long clone_flags, return p; bad_fork_cleanup_namespaces: - exit_task_namespaces(p); + put_and_finalize_nsproxy(p->nsproxy); bad_fork_cleanup_keys: exit_keys(p); bad_fork_cleanup_mm: @@ -1711,7 +1711,7 @@ asmlinkage long sys_unshare(unsigned long unshare_flags) } if (new_nsproxy) - put_nsproxy(new_nsproxy); + put_and_finalize_nsproxy(new_nsproxy); bad_unshare_cleanup_ipc: if (new_ipc) diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c index f5b9ee6..7b05bce 100644 --- a/kernel/nsproxy.c +++ b/kernel/nsproxy.c @@ -117,7 +117,7 @@ int copy_namespaces(int flags, struct task_struct *tsk) goto out_pid; out: - put_nsproxy(old_ns); + put_and_finalize_nsproxy(old_ns); return err; out_pid: @@ -135,6 +135,20 @@ out_ns: goto out; } +struct nsproxy *put_nsproxy(struct nsproxy *ns) +{ + if (ns) { + if (atomic_dec_and_test(&ns->count)) { + if (ns->mnt_ns) { + put_mnt_ns(ns->mnt_ns); + ns->mnt_ns = NULL; + } + return ns; + } + } + return NULL; +} + void free_nsproxy(struct nsproxy *ns) { if (ns->mnt_ns) |
