linux-kernel - Re: Broken "User namespaces: Only put the userns when we unhash the uid"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 22 Feb 2009 12:27:22 +0300
From:	Alexey Dobriyan <adobriyan@...il.com>
To:	David Howells <dhowells@...hat.com>
Cc:	kosaki.motohiro@...fujitsu.com, serue@...ibm.com, mingo@...e.hu,
	akpm@...l.org, linux-kernel@...r.kernel.org
Subject: Re: Broken "User namespaces: Only put the userns when we unhash
	the uid"

On Sun, Feb 22, 2009 at 12:37:59AM +0000, David Howells wrote:
> Alexey Dobriyan <adobriyan@...il.com> wrote:
> 
> > The following commit breaks clone(CLONE_NEWUSER)
> > with an oops.
> 
> Can you give the actual text of the oops, please?

One needs UP kernel for this. The box is really dead afterwards.

=============================================
[ INFO: possible recursive locking detected ]
2.6.29-rc5-2ec77fc93ca8731368fbe8e71f805c0569d4bcee #4
---------------------------------------------
swapper/0 is trying to acquire lock:
 (uidhash_lock){.+..}, at: [<c02182c8>] _atomic_dec_and_lock+0x18/0x40

but task is already holding lock:
 (uidhash_lock){.+..}, at: [<c02182c8>] _atomic_dec_and_lock+0x18/0x40

other info that might help us debug this:
1 lock held by swapper/0:
 #0:  (uidhash_lock){.+..}, at: [<c02182c8>] _atomic_dec_and_lock+0x18/0x40

stack backtrace:
Pid: 0, comm: swapper Not tainted 2.6.29-rc5-2ec77fc93ca8731368fbe8e71f805c0569d4bcee #4
Call Trace:
 [<c013ecd5>] validate_chain+0xac5/0x1130
 [<c013e5e0>] ? validate_chain+0x3d0/0x1130
 [<c013e5e0>] ? validate_chain+0x3d0/0x1130
 [<c013f5b6>] __lock_acquire+0x276/0xa10
 [<c013f5b6>] ? __lock_acquire+0x276/0xa10
 [<c013fdac>] lock_acquire+0x5c/0x80
 [<c02182c8>] ? _atomic_dec_and_lock+0x18/0x40
 [<c03bc0ac>] _spin_lock+0x3c/0x50
 [<c02182c8>] ? _atomic_dec_and_lock+0x18/0x40
 [<c02182c8>] _atomic_dec_and_lock+0x18/0x40
 [<c0125887>] free_uid+0x27/0xc0
 [<c01459f0>] ? free_user_ns+0x0/0x20
 [<c0145a01>] free_user_ns+0x11/0x20
 [<c021a4cb>] kref_put+0x2b/0x80
 [<c02182c8>] ? _atomic_dec_and_lock+0x18/0x40
 [<c01258c0>] free_uid+0x60/0xc0
 [<c013492f>] put_cred_rcu+0x2f/0x60
 [<c03bc709>] ? _spin_unlock_irqrestore+0x39/0x70
 [<c0148982>] __rcu_process_callbacks+0xd2/0x230
 [<c0148af2>] rcu_process_callbacks+0x12/0x30
 [<c012058a>] __do_softirq+0x7a/0x130
 [<c0120695>] do_softirq+0x55/0x60
 [<c012098b>] irq_exit+0x7b/0x80
 [<c0104f0e>] do_IRQ+0x3e/0x80
 [<c013da7c>] ? trace_hardirqs_on_caller+0xfc/0x190
 [<c01037ec>] common_interrupt+0x2c/0x34
 [<c01087df>] ? mwait_idle+0x3f/0x60
 [<c0101bc5>] cpu_idle+0x45/0x80
 [<c03af9f1>] rest_init+0x61/0x70
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/