linux-kernel - is pid_namespace leak in v3.10?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 5 Jul 2016 19:40:53 +0800
From:	Xishi Qiu <qiuxishi@...wei.com>
To:	<oleg@...hat.com>, <ebiederm@...ssion.com>
CC:	Linux MM <linux-mm@...ck.org>, LKML <linux-kernel@...r.kernel.org>
Subject: is pid_namespace leak in v3.10?

I find pid_namespace leak by "cat /proc/slabinfo | grep pid_namespace".
The kernel version is RHEL 7.1 (kernel v3.10 stable).
The following is the test case, after several times, the count of pid_namespace
become very large, is it correct?

I also test mainline, and the count will increase too, but it seems stably later.

BTW, this patch doesn't help.
24c037ebf5723d4d9ab0996433cee4f96c292a4d
exit: pidns: alloc_pid() leaks pid_namespace if child_reaper is exiting

Thanks,
Xishi Qiu

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <unistd.h>
#include <signal.h>

#ifndef CLONE_NEWPID
#define CLONE_NEWPID            0x20000000
#endif

void test(void)
{
        printf("clone child\n");
        exit(0);
}

int main()
{
        pid_t pid, child_pid;
        int  i, status;
        void *stack;

        for (i = 0; i < 100; i++) {
                stack = malloc(8192);
                pid = clone(&test, (char *)stack + 8192, CLONE_NEWPID|SIGCHLD, 0);
        }

        sleep(5);

        return 0;
}