Browse files

User namespaces: Only put the userns when we unhash the uid

uids in namespaces other than init don't get a sysfs entry.

For those in the init namespace, while we're waiting to remove
the sysfs entry for the uid the uid is still hashed, and
alloc_uid() may re-grab that uid without getting a new
reference to the user_ns, which we've already put in free_user
before scheduling remove_user_sysfs_dir().

Reported-and-tested-by: KOSAKI Motohiro <>
Signed-off-by: Serge E. Hallyn <>
Acked-by: David Howells <>
Tested-by: Ingo Molnar <>
Signed-off-by: Linus Torvalds <>
  • Loading branch information...
1 parent 37bed90 commit fb5ae64fdde29236e1a15e0366946df7060f41f2 Serge E. Hallyn committed with torvalds Feb 13, 2009
Showing with 1 addition and 2 deletions.
  1. +1 −2 kernel/user.c
@@ -72,6 +72,7 @@ static void uid_hash_insert(struct user_struct *up, struct hlist_head *hashent)
static void uid_hash_remove(struct user_struct *up)
+ put_user_ns(up->user_ns);
static struct user_struct *uid_hash_find(uid_t uid, struct hlist_head *hashent)
@@ -334,7 +335,6 @@ static void free_user(struct user_struct *up, unsigned long flags)
spin_unlock_irqrestore(&uidhash_lock, flags);
- put_user_ns(up->user_ns);
INIT_WORK(&up->work, remove_user_sysfs_dir);
@@ -357,7 +357,6 @@ static void free_user(struct user_struct *up, unsigned long flags)
- put_user_ns(up->user_ns);
kmem_cache_free(uid_cachep, up);

0 comments on commit fb5ae64

Please sign in to comment.