kernel/user.c: fix a memory leak when freeing up non-init usernamespaces users (be50b834) · Commits · 戴 / test

We were returning early in the sysfs directory cleanup function if the user belonged to a non init usernamespace. Due to this a lot of the cleanup was not done and we were left with a leak. Fix the leak. Reported-by:

Serge Hallyn <serue@linux.vnet.ibm.com> Signed-off-by:

Dhaval Giani <dhaval@linux.vnet.ibm.com> Acked-by:

Serge Hallyn <serue@us.ibm.com> Tested-by:

Serge Hallyn <serue@us.ibm.com> Signed-off-by:

Andrew Morton <akpm@linux-foundation.org> Signed-off-by:

Linus Torvalds <torvalds@linux-foundation.org>

kernel/user.c

+7 −7

Original line number	Diff line number	Diff line
		@@ -286,14 +286,12 @@ int __init uids_sysfs_init(void)
		/* work function to remove sysfs directory for a user and free up
		* corresponding structures.
		*/
		static void remove_user_sysfs_dir(struct work_struct *w)
		static void cleanup_user_struct(struct work_struct *w)
		{
		struct user_struct *up = container_of(w, struct user_struct, work);
		unsigned long flags;
		int remove_user = 0;

		if (up->user_ns != &init_user_ns)
		return;
		/* Make uid_hash_remove() + sysfs_remove_file() + kobject_del()
		* atomic.
		*/
		@@ -312,9 +310,11 @@ static void remove_user_sysfs_dir(struct work_struct *w)
		if (!remove_user)
		goto done;

		if (up->user_ns == &init_user_ns) {
		kobject_uevent(&up->kobj, KOBJ_REMOVE);
		kobject_del(&up->kobj);
		kobject_put(&up->kobj);
		}

		sched_destroy_user(up);
		key_put(up->uid_keyring);
		@@ -335,7 +335,7 @@ static void free_user(struct user_struct *up, unsigned long flags)
		atomic_inc(&up->__count);
		spin_unlock_irqrestore(&uidhash_lock, flags);

		INIT_WORK(&up->work, remove_user_sysfs_dir);
		INIT_WORK(&up->work, cleanup_user_struct);
		schedule_work(&up->work);
		}

Admin message