[PATCH] namespaces: fix task exit disaster

This is based on a patch by Eric W.  Biederman, who pointed out that pid
namespaces are still fake, and we only have one ever active.

So for the time being, we can modify any code which could access
tsk->nsproxy->pid_ns during task exit to just use &init_pid_ns instead,
and move the exit_task_namespaces call in do_exit() back above
exit_notify(), so that an exiting nfs server has a valid tsk->sighand to
work with.

Long term, pulling pid_ns out of nsproxy might be the cleanest solution.

Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
[ Eric's patch fixed to take care of free_pid() too ]

Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/include/linux/pid_namespace.h b/include/linux/pid_namespace.h
index d2a9d419f01f8903e12c4ab2da5e17a0d54f7481..2833806d42c635de975f76c3c078dd113c01b8e3 100644 (file)
--- a/include/linux/pid_namespace.h
+++ b/include/linux/pid_namespace.h
@@ -39,7 +39,7 @@ static inline void put_pid_ns(struct pid_namespace *ns)
 
 static inline struct task_struct *child_reaper(struct task_struct *tsk)
 {
-       return tsk->nsproxy->pid_ns->child_reaper;
+       return init_pid_ns.child_reaper;
 }
 
 #endif /* _LINUX_PID_NS_H */

diff --git a/kernel/exit.c b/kernel/exit.c
index 35401720635b4df01afe542c655ba350ac13d6a2..fec12eb124716f7e05e2564f241beef2049834cb 100644 (file)
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -938,8 +938,8 @@ fastcall NORET_TYPE void do_exit(long code)
 
        tsk->exit_code = code;
        proc_exit_connector(tsk);
-       exit_notify(tsk);
        exit_task_namespaces(tsk);
+       exit_notify(tsk);
 #ifdef CONFIG_NUMA
        mpol_free(tsk->mempolicy);
        tsk->mempolicy = NULL;

diff --git a/kernel/pid.c b/kernel/pid.c
index 2efe9d8d367b9346e1a38bc92027f0a24345029d..78f2aee90f541eb72b1616d1fc7405de865920fe 100644 (file)
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -197,7 +197,7 @@ fastcall void free_pid(struct pid *pid)
        hlist_del_rcu(&pid->pid_chain);
        spin_unlock_irqrestore(&pidmap_lock, flags);
 
-       free_pidmap(current->nsproxy->pid_ns, pid->nr);
+       free_pidmap(&init_pid_ns, pid->nr);
        call_rcu(&pid->rcu, delayed_put_pid);
 }