GitHub-Mirror/Star64_linux
2
0
Fork 0
mirror of https://github.com/Fishwaldo/Star64_linux.git synced 2025-06-22 06:32:08 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

userns: Avoid recursion in put_user_ns

Browse source 
When freeing a deeply nested user namespace free_user_ns calls
put_user_ns on it's parent which may in turn call free_user_ns again.
When -fno-optimize-sibling-calls is passed to gcc one stack frame per
user namespace is left on the stack, potentially overflowing the
kernel stack.  CONFIG_FRAME_POINTER forces -fno-optimize-sibling-calls
so we can't count on gcc to optimize this code.

Remove struct kref and use a plain atomic_t.  Making the code more
flexible and easier to comprehend.  Make the loop in free_user_ns
explict to guarantee that the stack does not overflow with
CONFIG_FRAME_POINTER enabled.

I have tested this fix with a simple program that uses unshare to
create a deeply nested user namespace structure and then calls exit.
With 1000 nesteuser namespaces before this change running my test
program causes the kernel to die a horrible death.  With 10,000,000
nested user namespaces after this change my test program runs to
completion and causes no harm.

Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Pointed-out-by: Vasily Kulikov <segoon@openwall.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
This commit is contained in:
Eric W. Biederman 2012-12-28 18:58:39 -08:00
parent 923c753823
commit c61a2810a2
3 changed files with 15 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

10
include/linux/user_namespace.h
View file

@ -21,7 +21,7 @@ struct user_namespace {
struct uid_gid_map uid_map; struct uid_gid_map uid_map;
struct uid_gid_map gid_map; struct uid_gid_map gid_map;
struct uid_gid_map projid_map; struct uid_gid_map projid_map;
struct kref kref; atomic_t count;
struct user_namespace *parent; struct user_namespace *parent;
kuid_t owner; kuid_t owner;
kgid_t group; kgid_t group;
@ -35,18 +35,18 @@ extern struct user_namespace init_user_ns;
static inline struct user_namespace *get_user_ns(struct user_namespace *ns) static inline struct user_namespace *get_user_ns(struct user_namespace *ns)
{ {
if (ns) if (ns)
kref_get(&ns->kref); atomic_inc(&ns->count);
return ns; return ns;
} }
extern int create_user_ns(struct cred *new); extern int create_user_ns(struct cred *new);
extern int unshare_userns(unsigned long unshare_flags, struct cred **new_cred); extern int unshare_userns(unsigned long unshare_flags, struct cred **new_cred);
extern void free_user_ns(struct kref *kref); extern void free_user_ns(struct user_namespace *ns);
static inline void put_user_ns(struct user_namespace *ns) static inline void put_user_ns(struct user_namespace *ns)
{ {
if (ns) if (ns && atomic_dec_and_test(&ns->count))
kref_put(&ns->kref, free_user_ns); free_user_ns(ns);
} }
struct seq_operations; struct seq_operations;

4
kernel/user.c
View file

@ -47,9 +47,7 @@ struct user_namespace init_user_ns = {
.count = 4294967295U, .count = 4294967295U,
}, },
}, },
.kref = { .count = ATOMIC_INIT(3),
.refcount = ATOMIC_INIT(3),
},
.owner = GLOBAL_ROOT_UID, .owner = GLOBAL_ROOT_UID,
.group = GLOBAL_ROOT_GID, .group = GLOBAL_ROOT_GID,
.proc_inum = PROC_USER_INIT_INO, .proc_inum = PROC_USER_INIT_INO,

17
kernel/user_namespace.c
View file

@ -78,7 +78,7 @@ int create_user_ns(struct cred *new)
return ret; return ret;
} }
kref_init(&ns->kref); atomic_set(&ns->count, 1);
/* Leave the new->user_ns reference with the new user namespace. */ /* Leave the new->user_ns reference with the new user namespace. */
ns->parent = parent_ns; ns->parent = parent_ns;
ns->owner = owner; ns->owner = owner;
@ -104,15 +104,16 @@ int unshare_userns(unsigned long unshare_flags, struct cred **new_cred)
return create_user_ns(cred); return create_user_ns(cred);
} }
void free_user_ns(struct kref *kref) void free_user_ns(struct user_namespace *ns)
{ {
struct user_namespace *parent, *ns = struct user_namespace *parent;
container_of(kref, struct user_namespace, kref);
parent = ns->parent; do {
proc_free_inum(ns->proc_inum); parent = ns->parent;
kmem_cache_free(user_ns_cachep, ns); proc_free_inum(ns->proc_inum);
put_user_ns(parent); kmem_cache_free(user_ns_cachep, ns);
ns = parent;
} while (atomic_dec_and_test(&parent->count));
} }
EXPORT_SYMBOL(free_user_ns); EXPORT_SYMBOL(free_user_ns);