[PATCH] namespaces: fix task exit disaster (0f245285) · Commits · 戴 / test

This is based on a patch by Eric W. Biederman, who pointed out that pid namespaces are still fake, and we only have one ever active. So for the time being, we can modify any code which could access tsk->nsproxy->pid_ns during task exit to just use &init_pid_ns instead, and move the exit_task_namespaces call in do_exit() back above exit_notify(), so that an exiting nfs server has a valid tsk->sighand to work with. Long term, pulling pid_ns out of nsproxy might be the cleanest solution. Signed-off-by:

Eric W. Biederman <ebiederm@xmission.com> [ Eric's patch fixed to take care of free_pid() too ] Signed-off-by:

Serge E. Hallyn <serue@us.ibm.com> Signed-off-by:

Linus Torvalds <torvalds@linux-foundation.org>

include/linux/pid_namespace.h

+1 −1

Original line number	Diff line number	Diff line
		@@ -39,7 +39,7 @@ static inline void put_pid_ns(struct pid_namespace *ns)

		static inline struct task_struct child_reaper(struct task_struct tsk)
		{
		return tsk->nsproxy->pid_ns->child_reaper;
		return init_pid_ns.child_reaper;
		}

		#endif /* _LINUX_PID_NS_H */

kernel/exit.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -938,8 +938,8 @@ fastcall NORET_TYPE void do_exit(long code)

		tsk->exit_code = code;
		proc_exit_connector(tsk);
		exit_notify(tsk);
		exit_task_namespaces(tsk);
		exit_notify(tsk);
		#ifdef CONFIG_NUMA
		mpol_free(tsk->mempolicy);
		tsk->mempolicy = NULL;

kernel/pid.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -197,7 +197,7 @@ fastcall void free_pid(struct pid *pid)
		hlist_del_rcu(&pid->pid_chain);
		spin_unlock_irqrestore(&pidmap_lock, flags);

		free_pidmap(current->nsproxy->pid_ns, pid->nr);
		free_pidmap(&init_pid_ns, pid->nr);
		call_rcu(&pid->rcu, delayed_put_pid);
		}

Admin message