Re: [PATCH] pidns: remove recursion from free_pid_ns() v5

2012-10-10 Thread Cyrill Gorcunov
On Wed, Oct 10, 2012 at 01:54:08PM -0700, Andrew Morton wrote: > On Thu, 11 Oct 2012 00:42:56 +0400 > Cyrill Gorcunov wrote: > > > The free_pid_ns function done in recursion fashion: > > > > free_pid_ns(parent) > > put_pid_ns(parent) > > kref_put(&ns->kref, free_pid_ns); > > free_pid

Re: [PATCH] pidns: remove recursion from free_pid_ns() v5

2012-10-10 Thread Eric W. Biederman
Andrew Morton writes: > On Thu, 11 Oct 2012 00:42:56 +0400 > Cyrill Gorcunov wrote: > >> The free_pid_ns function done in recursion fashion: >> >> free_pid_ns(parent) >> put_pid_ns(parent) >> kref_put(&ns->kref, free_pid_ns); >> free_pid_ns >> >> thus if there was a huge nesting of

Re: [PATCH] pidns: remove recursion from free_pid_ns() v5

2012-10-10 Thread Andrew Morton
On Thu, 11 Oct 2012 00:42:56 +0400 Cyrill Gorcunov wrote: > The free_pid_ns function done in recursion fashion: > > free_pid_ns(parent) > put_pid_ns(parent) > kref_put(&ns->kref, free_pid_ns); > free_pid_ns > > thus if there was a huge nesting of namespaces the userspace > may trigg

[PATCH] pidns: remove recursion from free_pid_ns() v5

2012-10-10 Thread Cyrill Gorcunov
The free_pid_ns function done in recursion fashion: free_pid_ns(parent) put_pid_ns(parent) kref_put(&ns->kref, free_pid_ns); free_pid_ns thus if there was a huge nesting of namespaces the userspace may trigger avalanche calling of free_pid_ns leading to kernel stack exhausting and a p

Re: [PATCH] pidns: remove recursion from free_pid_ns (v3)

2012-10-10 Thread Cyrill Gorcunov
On Wed, Oct 10, 2012 at 05:12:21PM +0800, Xiaotian Feng wrote: > > > > Is a kref even the correct thing here? > > Can we fix this by this way? free_pid_ns just release ns itself, we check > the return value of kref_put, if kref_put returns 1, means ns->kref is > removed, > then we kref_put(ns->pa

Re: [PATCH] pidns: remove recursion from free_pid_ns (v3)

2012-10-10 Thread Xiaotian Feng
On Wed, Oct 10, 2012 at 5:12 PM, Xiaotian Feng wrote: > On Wed, Oct 10, 2012 at 3:49 PM, Greg KH wrote: >> On Tue, Oct 09, 2012 at 12:08:31PM -0700, Andrew Morton wrote: >>> On Tue, 9 Oct 2012 12:03:00 -0700 >>> Greg KH wrote: >>> >>> > On Tue, Oct 09, 2012 at 11:48:21AM -0700, Andrew Morton wro

Re: [PATCH] pidns: remove recursion from free_pid_ns (v3)

2012-10-10 Thread Xiaotian Feng
On Wed, Oct 10, 2012 at 3:49 PM, Greg KH wrote: > On Tue, Oct 09, 2012 at 12:08:31PM -0700, Andrew Morton wrote: >> On Tue, 9 Oct 2012 12:03:00 -0700 >> Greg KH wrote: >> >> > On Tue, Oct 09, 2012 at 11:48:21AM -0700, Andrew Morton wrote: >> > > On Sat, 6 Oct 2012 23:56:33 +0400 >> > > Andrew Va

Re: [PATCH] pidns: remove recursion from free_pid_ns (v3)

2012-10-10 Thread Greg KH
On Tue, Oct 09, 2012 at 12:08:31PM -0700, Andrew Morton wrote: > On Tue, 9 Oct 2012 12:03:00 -0700 > Greg KH wrote: > > > On Tue, Oct 09, 2012 at 11:48:21AM -0700, Andrew Morton wrote: > > > On Sat, 6 Oct 2012 23:56:33 +0400 > > > Andrew Vagin wrote: > > > > > > > Here is a stack trace of recu

Re: [PATCH] pidns: remove recursion from free_pid_ns (v3)

2012-10-09 Thread Andrew Morton
On Tue, 9 Oct 2012 12:03:00 -0700 Greg KH wrote: > On Tue, Oct 09, 2012 at 11:48:21AM -0700, Andrew Morton wrote: > > On Sat, 6 Oct 2012 23:56:33 +0400 > > Andrew Vagin wrote: > > > > > Here is a stack trace of recursion: > > > free_pid_ns(parent) > > > put_pid_ns(parent) > > > kref_put(

Re: [PATCH] pidns: remove recursion from free_pid_ns (v3)

2012-10-09 Thread Greg KH
On Tue, Oct 09, 2012 at 11:48:21AM -0700, Andrew Morton wrote: > On Sat, 6 Oct 2012 23:56:33 +0400 > Andrew Vagin wrote: > > > Here is a stack trace of recursion: > > free_pid_ns(parent) > > put_pid_ns(parent) > > kref_put(&ns->kref, free_pid_ns); > > free_pid_ns > > > > This patch

Re: [PATCH] pidns: remove recursion from free_pid_ns (v3)

2012-10-09 Thread Andrew Morton
On Sat, 6 Oct 2012 23:56:33 +0400 Andrew Vagin wrote: > Here is a stack trace of recursion: > free_pid_ns(parent) > put_pid_ns(parent) > kref_put(&ns->kref, free_pid_ns); > free_pid_ns > > This patch turns recursion into loops. > > pidns can be nested many times, so in case of recu

[PATCH] pidns: remove recursion from free_pid_ns (v3)

2012-10-06 Thread Andrew Vagin
Here is a stack trace of recursion: free_pid_ns(parent) put_pid_ns(parent) kref_put(&ns->kref, free_pid_ns); free_pid_ns This patch turns recursion into loops. pidns can be nested many times, so in case of recursion a simple user space program can provoke a kernel panic due to exceed

Re: [PATCH] pidns: remove recursion from free_pid_ns (v2)

2012-10-06 Thread Oleg Nesterov
On 10/06, Andrew Vagin wrote: > > --- a/kernel/pid_namespace.c > +++ b/kernel/pid_namespace.c > @@ -138,11 +138,20 @@ void free_pid_ns(struct kref *kref) > > ns = container_of(kref, struct pid_namespace, kref); > > - parent = ns->parent; > - destroy_pid_namespace(ns); > + whil

[PATCH] pidns: remove recursion from free_pid_ns (v2)

2012-10-06 Thread Andrew Vagin
Here is a stack trace of recursion: free_pid_ns(parent) put_pid_ns(parent) kref_put(&ns->kref, free_pid_ns); free_pid_ns This patch turns recursion into loops. pidns can be nested many times, so in case of recursion a simple user space program can provoke a kernel panic due to exceed

Re: [PATCH] pidns: remove recursion from free_pid_ns

2012-10-05 Thread Oleg Nesterov
On 10/05, Andrew Vagin wrote: > > Here is a stack trace of recursion: > free_pid_ns(parent) > put_pid_ns(parent) > kref_put(&ns->kref, free_pid_ns); > free_pid_ns > > This patch turns recursion into loops. I think the patch is correct, a couple of minor nits. > +static inline int __kr

Re: [PATCH] pidns: remove recursion from free_pid_ns

2012-10-04 Thread Cyrill Gorcunov
On Fri, Oct 05, 2012 at 01:21:02AM +0400, Andrew Vagin wrote: > Here is a stack trace of recursion: > free_pid_ns(parent) > put_pid_ns(parent) > kref_put(&ns->kref, free_pid_ns); > free_pid_ns > > This patch turns recursion into loops. > > pidns can be nested many times, so in case of

[PATCH] pidns: remove recursion from free_pid_ns

2012-10-04 Thread Andrew Vagin
Here is a stack trace of recursion: free_pid_ns(parent) put_pid_ns(parent) kref_put(&ns->kref, free_pid_ns); free_pid_ns This patch turns recursion into loops. pidns can be nested many times, so in case of recursion a simple user space program can provoke a kernel panic due to exceed