2009-03-06 05:27:33

by Dhaval Giani

Subject: [PATCH] Fix a memory leak when freeing up non init usernamespaces users

Fix a memory leak when freeing up non init usernamespaces users

We were returning early in the sysfs directory cleanup function
if the user belonged to a non init usernamespace. Due to this a lot
of the cleanup was not done and we were left with a leak. Fix the leak.

Reported-by: Serge Hallyn <[email protected]>
Signed-off-by: Dhaval Giani <[email protected]>
Acked-by: Serge Hallyn <[email protected]>
Tested-by: Serge Hallyn <[email protected]>
---
kernel/user.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)

Index: linux-2.6/kernel/user.c
===================================================================
--- linux-2.6.orig/kernel/user.c
+++ linux-2.6/kernel/user.c
@@ -286,14 +286,12 @@ int __init uids_sysfs_init(void)
/* work function to remove sysfs directory for a user and free up
* corresponding structures.
*/
-static void remove_user_sysfs_dir(struct work_struct *w)
+static void cleanup_user_struct(struct work_struct *w)
{
struct user_struct *up = container_of(w, struct user_struct, work);
unsigned long flags;
int remove_user = 0;

- if (up->user_ns != &init_user_ns)
- return;
/* Make uid_hash_remove() + sysfs_remove_file() + kobject_del()
* atomic.
*/
@@ -312,9 +310,11 @@ static void remove_user_sysfs_dir(struct
if (!remove_user)
goto done;

- kobject_uevent(&up->kobj, KOBJ_REMOVE);
- kobject_del(&up->kobj);
- kobject_put(&up->kobj);
+ if (up->user_ns == &init_user_ns) {
+ kobject_uevent(&up->kobj, KOBJ_REMOVE);
+ kobject_del(&up->kobj);
+ kobject_put(&up->kobj);
+ }

sched_destroy_user(up);
key_put(up->uid_keyring);
@@ -335,7 +335,7 @@ static void free_user(struct user_struct
atomic_inc(&up->__count);
spin_unlock_irqrestore(&uidhash_lock, flags);

- INIT_WORK(&up->work, remove_user_sysfs_dir);
+ INIT_WORK(&up->work, cleanup_user_struct);
schedule_work(&up->work);
}

--
regards,
Dhaval

2009-03-06 13:55:21

by Serge E. Hallyn

Subject: Re: [PATCH] Fix a memory leak when freeing up non init usernamespaces users

Quoting Dhaval Giani ([email protected]):
>
> Fix a memory leak when freeing up non init usernamespaces users
>
> We were returning early in the sysfs directory cleanup function
> if the user belonged to a non init usernamespace. Due to this a lot
> of the cleanup was not done and we were left with a leak. Fix the leak.
>
> Reported-by: Serge Hallyn <[email protected]>
> Signed-off-by: Dhaval Giani <[email protected]>
> Acked-by: Serge Hallyn <[email protected]>
> Tested-by: Serge Hallyn <[email protected]>

Thanks, Dhaval.

-serge

> ---
> kernel/user.c | 14 +++++++-------
> 1 file changed, 7 insertions(+), 7 deletions(-)
>
> Index: linux-2.6/kernel/user.c
> ===================================================================
> --- linux-2.6.orig/kernel/user.c
> +++ linux-2.6/kernel/user.c
> @@ -286,14 +286,12 @@ int __init uids_sysfs_init(void)
> /* work function to remove sysfs directory for a user and free up
> * corresponding structures.
> */
> -static void remove_user_sysfs_dir(struct work_struct *w)
> +static void cleanup_user_struct(struct work_struct *w)
> {
> struct user_struct *up = container_of(w, struct user_struct, work);
> unsigned long flags;
> int remove_user = 0;
>
> - if (up->user_ns != &init_user_ns)
> - return;
> /* Make uid_hash_remove() + sysfs_remove_file() + kobject_del()
> * atomic.
> */
> @@ -312,9 +310,11 @@ static void remove_user_sysfs_dir(struct
> if (!remove_user)
> goto done;
>
> - kobject_uevent(&up->kobj, KOBJ_REMOVE);
> - kobject_del(&up->kobj);
> - kobject_put(&up->kobj);
> + if (up->user_ns == &init_user_ns) {
> + kobject_uevent(&up->kobj, KOBJ_REMOVE);
> + kobject_del(&up->kobj);
> + kobject_put(&up->kobj);
> + }
>
> sched_destroy_user(up);
> key_put(up->uid_keyring);
> @@ -335,7 +335,7 @@ static void free_user(struct user_struct
> atomic_inc(&up->__count);
> spin_unlock_irqrestore(&uidhash_lock, flags);
>
> - INIT_WORK(&up->work, remove_user_sysfs_dir);
> + INIT_WORK(&up->work, cleanup_user_struct);
> schedule_work(&up->work);
> }
>
> --
> regards,
> Dhaval