3.6.11.9-rc1 stable review patch. If anyone has any objections, please let me know. ------------------ From: Oleg Nesterov [ Upstream commit 8742f229b635bf1c1c84a3dfe5e47c814c20b5c8 ] Ensure that user_namespace->parent chain can't grow too much. Currently we use the hardroded 32 as limit. Reported-by: Andy Lutomirski Signed-off-by: Oleg Nesterov Signed-off-by: Linus Torvalds Signed-off-by: Steven Rostedt --- include/linux/user_namespace.h | 1 + kernel/user_namespace.c | 4 ++++ 2 files changed, 5 insertions(+) diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h index 4e72922..4eea4ce 100644 --- a/include/linux/user_namespace.h +++ b/include/linux/user_namespace.h @@ -22,6 +22,7 @@ struct user_namespace { struct uid_gid_map gid_map; struct kref kref; struct user_namespace *parent; + int level; kuid_t owner; kgid_t group; }; diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c index a74dc5b..5242e83 100644 --- a/kernel/user_namespace.c +++ b/kernel/user_namespace.c @@ -39,6 +39,9 @@ int create_user_ns(struct cred *new) kuid_t owner = new->euid; kgid_t group = new->egid; + if (parent_ns->level > 32) + return -EUSERS; + /* * Verify that we can not violate the policy of which files * may be accessed that is specified by the root directory, @@ -62,6 +65,7 @@ int create_user_ns(struct cred *new) kref_init(&ns->kref); ns->parent = parent_ns; + ns->level = parent_ns->level + 1; ns->owner = owner; ns->group = group; -- 1.7.10.4 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/