diff options
| author | Cedric Le Goater <clg@fr.ibm.com> | 2007-06-23 17:16:25 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@woody.linux-foundation.org> | 2007-06-24 08:59:10 -0700 |
| commit | 4e71e474c784dc274f28ec8bb22a5dbabc6dc7c5 (patch) | |
| tree | 2a14a2d1efe99fe2a8e9c01ba851d6c28ddbef23 | |
| parent | 6d79af701d334777541136e914a9c0969b2ad307 (diff) | |
| download | linux-4e71e474c784dc274f28ec8bb22a5dbabc6dc7c5.tar.bz2 | |
fix refcounting of nsproxy object when unshared
When a namespace is unshared, a refcount on the previous nsproxy is
abusively taken, leading to a memory leak of nsproxy objects.
Signed-off-by: Cedric Le Goater <clg@fr.ibm.com>
Cc: Badari Pulavarty <pbadari@us.ibm.com>
Cc: Herbert Poetzl <herbert@13thfloor.at>
Cc: Oleg Nesterov <oleg@tv-sign.ru>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
| -rw-r--r-- | kernel/nsproxy.c | 10 |
1 files changed, 2 insertions, 8 deletions
diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c index 1bc4b55241a8..9e83b589f754 100644 --- a/kernel/nsproxy.c +++ b/kernel/nsproxy.c @@ -145,13 +145,11 @@ void free_nsproxy(struct nsproxy *ns) /* * Called from unshare. Unshare all the namespaces part of nsproxy. - * On sucess, returns the new nsproxy and a reference to old nsproxy - * to make sure it stays around. + * On success, returns the new nsproxy. */ int unshare_nsproxy_namespaces(unsigned long unshare_flags, struct nsproxy **new_nsp, struct fs_struct *new_fs) { - struct nsproxy *old_ns = current->nsproxy; int err = 0; if (!(unshare_flags & (CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWIPC))) @@ -170,13 +168,9 @@ int unshare_nsproxy_namespaces(unsigned long unshare_flags, if (!capable(CAP_SYS_ADMIN)) return -EPERM; - get_nsproxy(old_ns); - *new_nsp = create_new_namespaces(unshare_flags, current, new_fs ? new_fs : current->fs); - if (IS_ERR(*new_nsp)) { + if (IS_ERR(*new_nsp)) err = PTR_ERR(*new_nsp); - put_nsproxy(old_ns); - } return err; } |