From 7a238fcba0629b6f2edbcd37458bae56fcf36be5 Mon Sep 17 00:00:00 2001 From: "Serge E. Hallyn" Date: Mon, 29 Jan 2007 13:19:40 -0800 Subject: [PATCH] namespaces: fix exit race by splitting exit Fix exit race by splitting the nsproxy putting into two pieces. First piece reduces the nsproxy refcount. If we dropped the last reference, then it puts the mnt_ns, and returns the nsproxy as a hint to the caller. Else it returns NULL. The second piece of exiting task namespaces sets tsk->nsproxy to NULL, and drops the references to other namespaces and frees the nsproxy only if an nsproxy was passed in. A little awkward and should probably be reworked, but hopefully it fixes the NFS oops. Signed-off-by: Serge E. Hallyn Cc: Herbert Poetzl Cc: Oleg Nesterov Cc: "Eric W. Biederman" Cc: Cedric Le Goater Cc: Daniel Hokka Zakrisson Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- kernel/nsproxy.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) (limited to 'kernel/nsproxy.c') diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c index f5b9ee6f6bb..7b05bce75cd 100644 --- a/kernel/nsproxy.c +++ b/kernel/nsproxy.c @@ -117,7 +117,7 @@ int copy_namespaces(int flags, struct task_struct *tsk) goto out_pid; out: - put_nsproxy(old_ns); + put_and_finalize_nsproxy(old_ns); return err; out_pid: @@ -135,6 +135,20 @@ out_ns: goto out; } +struct nsproxy *put_nsproxy(struct nsproxy *ns) +{ + if (ns) { + if (atomic_dec_and_test(&ns->count)) { + if (ns->mnt_ns) { + put_mnt_ns(ns->mnt_ns); + ns->mnt_ns = NULL; + } + return ns; + } + } + return NULL; +} + void free_nsproxy(struct nsproxy *ns) { if (ns->mnt_ns) -- cgit v1.2.3