Fix user namespace exiting OOPs

[sfrench/cifs-2.6.git] / kernel / user.c

diff --git a/kernel/user.c b/kernel/user.c
index 4869563080e9e080954d26f34b70bbffc13de18b..9ca2848fc35676fa8ebac52f20c33f7f056d09ff 100644 (file)
--- a/kernel/user.c
+++ b/kernel/user.c
@@ -14,20 +14,19 @@
 #include <linux/bitops.h>
 #include <linux/key.h>
 #include <linux/interrupt.h>
+#include <linux/module.h>
+#include <linux/user_namespace.h>
 
 /*
  * UID task count cache, to get fast user lookup in "alloc_uid"
  * when changing user ID's (ie setuid() and friends).
  */
 
-#define UIDHASH_BITS (CONFIG_BASE_SMALL ? 3 : 8)
-#define UIDHASH_SZ             (1 << UIDHASH_BITS)
 #define UIDHASH_MASK           (UIDHASH_SZ - 1)
 #define __uidhashfn(uid)       (((uid >> UIDHASH_BITS) + uid) & UIDHASH_MASK)
-#define uidhashentry(uid)      (uidhash_table + __uidhashfn((uid)))
+#define uidhashentry(ns, uid)  ((ns)->uidhash_table + __uidhashfn((uid)))
 
 static struct kmem_cache *uid_cachep;
-static struct list_head uidhash_table[UIDHASH_SZ];
 
 /*
  * The uidhash_lock is mostly taken from process context, but it is
@@ -56,25 +55,22 @@ struct user_struct root_user = {
 /*
  * These routines must be called with the uidhash spinlock held!
  */
-static inline void uid_hash_insert(struct user_struct *up, struct list_head *hashent)
+static inline void uid_hash_insert(struct user_struct *up, struct hlist_head *hashent)
 {
-       list_add(&up->uidhash_list, hashent);
+       hlist_add_head(&up->uidhash_node, hashent);
 }
 
 static inline void uid_hash_remove(struct user_struct *up)
 {
-       list_del(&up->uidhash_list);
+       hlist_del_init(&up->uidhash_node);
 }
 
-static inline struct user_struct *uid_hash_find(uid_t uid, struct list_head *hashent)
+static inline struct user_struct *uid_hash_find(uid_t uid, struct hlist_head *hashent)
 {
-       struct list_head *up;
-
-       list_for_each(up, hashent) {
-               struct user_struct *user;
-
-               user = list_entry(up, struct user_struct, uidhash_list);
+       struct user_struct *user;
+       struct hlist_node *h;
 
+       hlist_for_each_entry(user, h, hashent, uidhash_node) {
                if(user->uid == uid) {
                        atomic_inc(&user->__count);
                        return user;
@@ -94,9 +90,10 @@ struct user_struct *find_user(uid_t uid)
 {
        struct user_struct *ret;
        unsigned long flags;
+       struct user_namespace *ns = current->nsproxy->user_ns;
 
        spin_lock_irqsave(&uidhash_lock, flags);
-       ret = uid_hash_find(uid, uidhashentry(uid));
+       ret = uid_hash_find(uid, uidhashentry(ns, uid));
        spin_unlock_irqrestore(&uidhash_lock, flags);
        return ret;
 }
@@ -120,9 +117,9 @@ void free_uid(struct user_struct *up)
        }
 }
 
-struct user_struct * alloc_uid(uid_t uid)
+struct user_struct * alloc_uid(struct user_namespace *ns, uid_t uid)
 {
-       struct list_head *hashent = uidhashentry(uid);
+       struct hlist_head *hashent = uidhashentry(ns, uid);
        struct user_struct *up;
 
        spin_lock_irq(&uidhash_lock);
@@ -202,20 +199,44 @@ void switch_uid(struct user_struct *new_user)
        suid_keys(current);
 }
 
+void release_uids(struct user_namespace *ns)
+{
+       int i;
+       unsigned long flags;
+       struct hlist_head *head;
+       struct hlist_node *nd;
+
+       spin_lock_irqsave(&uidhash_lock, flags);
+       /*
+        * collapse the chains so that the user_struct-s will
+        * be still alive, but not in hashes. subsequent free_uid()
+        * will free them.
+        */
+       for (i = 0; i < UIDHASH_SZ; i++) {
+               head = ns->uidhash_table + i;
+               while (!hlist_empty(head)) {
+                       nd = head->first;
+                       hlist_del_init(nd);
+               }
+       }
+       spin_unlock_irqrestore(&uidhash_lock, flags);
+
+       free_uid(ns->root_user);
+}
 
 static int __init uid_cache_init(void)
 {
        int n;
 
        uid_cachep = kmem_cache_create("uid_cache", sizeof(struct user_struct),
-                       0, SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL, NULL);
+                       0, SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
 
        for(n = 0; n < UIDHASH_SZ; ++n)
-               INIT_LIST_HEAD(uidhash_table + n);
+               INIT_HLIST_HEAD(init_user_ns.uidhash_table + n);
 
        /* Insert the root user immediately (init already runs as root) */
        spin_lock_irq(&uidhash_lock);
-       uid_hash_insert(&root_user, uidhashentry(0));
+       uid_hash_insert(&root_user, uidhashentry(&init_user_ns, 0));
        spin_unlock_irq(&uidhash_lock);
 
        return 0;