Date: Thu, 2 Jul 2009 11:37:31 -0500
From: "Serge E. Hallyn" <serue@us.ibm.com>
To: Paul Menage <menage@google.com>
Cc: Li Zefan <lizf@cn.fujitsu.com>, Andrew Morton <akpm@linux-foundation.org>,
       LKML <linux-kernel@vger.kernel.org>,
       Linux Containers <containers@lists.linux-foundation.org>
Subject: Re: [PATCH][BUGFIX] cgroups: fix pid namespace bug
Message-ID: <20090702163731.GA14267@us.ibm.com>
References: <4A4C0C60.4050106@cn.fujitsu.com> <6599ad830907020926t6305bec9t44a50cc165f6fc28@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <6599ad830907020926t6305bec9t44a50cc165f6fc28@mail.gmail.com>
User-Agent: Mutt/1.5.18 (2008-05-17)
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1273
Lines: 35

Quoting Paul Menage (menage@google.com):
> On Wed, Jul 1, 2009 at 6:24 PM, Li Zefan<lizf@cn.fujitsu.com> wrote:
> > + ? ? ? cp = kzalloc(sizeof(*cp), GFP_KERNEL);
> > + ? ? ? if (!cp) {
> > + ? ? ? ? ? ? ? up_write(&cgrp->pids_mutex);
> > + ? ? ? ? ? ? ? kfree(pidarray);
> > + ? ? ? ? ? ? ? return -ENOMEM;
> > + ? ? ? }
> > + ? ? ? cp->cgrp = cgrp;
> > + ? ? ? cp->pid_ns = pid_ns;
> 
> You're storing an uncounted reference to the pid ns here - there's no
> guarantee that the pid_ns will outlive the open file.

Yeah I was thinking about that, but

	1. the only way it won't outlive the open file is if the 
		task opens the file, hands the open fd over a
		unix socket, then exits as the last task of its
		pidns
	2. We don't dereference the pid_ns, so there is no actual
		safety issue.  So it would become a problem only
		if a new pidns gets created at that same address
		*and* a task in the new pidns opens the same
		tasks file.

Still, it wouldn't hurt to do get_pid_ns/put_pid_ns at the open
and release :)

-serge
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/