The patch titled user namespaces: only put the userns when we unhash the uid has been added to the -mm tree. Its filename is user-namespaces-only-put-the-userns-when-we-unhash-the-uid.patch Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/SubmitChecklist when testing your code *** See http://userweb.kernel.org/~akpm/stuff/added-to-mm.txt to find out what to do about this The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/ ------------------------------------------------------ Subject: user namespaces: only put the userns when we unhash the uid From: "Serge E. Hallyn" <serue@xxxxxxxxxx> uids in namespaces other than init don't get a sysfs entry. For those in the init namespace, while we're waiting to remove the sysfs entry for the uid the uid is still hashed, and alloc_uid() may re-grab that uid without getting a new reference to the user_ns, which we've already put in free_user before scheduling remove_user_sysfs_dir(). Signed-off-by: Serge E. Hallyn <serue@xxxxxxxxxx> Acked-by: David Howells <dhowells@xxxxxxxxxx> Cc: Vegard Nossum <vegard.nossum@xxxxxxxxx> Cc: Eric Sesterhenn <snakebyte@xxxxxx> Cc: Dhaval Giani <dhaval@xxxxxxxxxxxxxxxxxx> Cc: Peter Zijlstra <a.p.zijlstra@xxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- kernel/user.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff -puN kernel/user.c~user-namespaces-only-put-the-userns-when-we-unhash-the-uid kernel/user.c --- a/kernel/user.c~user-namespaces-only-put-the-userns-when-we-unhash-the-uid +++ a/kernel/user.c @@ -72,6 +72,7 @@ static void uid_hash_insert(struct user_ static void uid_hash_remove(struct user_struct *up) { hlist_del_init(&up->uidhash_node); + put_user_ns(up->user_ns); } static struct user_struct *uid_hash_find(uid_t uid, struct hlist_head *hashent) @@ -334,7 +335,6 @@ static void free_user(struct user_struct atomic_inc(&up->__count); spin_unlock_irqrestore(&uidhash_lock, flags); - put_user_ns(up->user_ns); INIT_WORK(&up->work, remove_user_sysfs_dir); schedule_work(&up->work); } @@ -357,7 +357,6 @@ static void free_user(struct user_struct sched_destroy_user(up); key_put(up->uid_keyring); key_put(up->session_keyring); - put_user_ns(up->user_ns); kmem_cache_free(uid_cachep, up); } _ Patches currently in -mm which might be from serue@xxxxxxxxxx are linux-next.patch vfs-simple_set_mnt-should-return-void.patch user-namespaces-only-put-the-userns-when-we-unhash-the-uid.patch relax-ns_can_attach-checks-to-allow-attaching-to-grandchild-cgroups.patch pids-kill-now-unused-signal_struct-__pgrp-__session-and-friends.patch reiser4.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html