On Wed, Mar 14, 2012 at 11:03:43PM +0200, Sasha Levin wrote: > > And that's all pointers to mnt_namespace that ever exist, aside of function > > arguments and local variables. ?I'm not saying that I couldn't have possibly > > fucked it up, but from rereading that code it doesn't look like we could > > end up with dangling pointers to already freed instances... > > I'm trying to find the exact chain of events leading it it at the > moment, but it reproduces rather easily - so if you have any ideas on > figuring it out I'm happy to try anything. Which kernel, for starters? I'd probably add dumping call chain + return value in alloc_mnt_ns(), call chain + pointer being freed in final put_mnt_ns() and failure exit of dup_mnt_ns(), address of mnt_ns and value assigned to ->root on assignments to ->root in create_mnt_ns() and dup_mnt_ns() and mnt_ns in dup_mnt_ns() if it happens to have NULL ->root. That should give you full history of allocation/freeing mnt_namespace instances and of assignments to anyone's ->root. Ought to make a sane starting point... -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
