-
由 Eric W. Biederman 提交于
Always increment/decrement ucount->count under the ucounts_lock. The increments are there already and moving the decrements there means the locking logic of the code is simpler. This simplification in the locking logic fixes a race between put_ucounts and get_ucounts that could result in a use-after-free because the count could go zero then be found by get_ucounts and then be freed by put_ucounts. A bug presumably this one was found by a combination of syzkaller and KASAN. JongWhan Kim reported the syzkaller failure and Dmitry Vyukov spotted the race in the code. Cc: stable@vger.kernel.org Fixes: f6b2db1a ("userns: Make the count of user namespaces per user") Reported-by: NJongHwan Kim <zzoru007@gmail.com> Reported-by: NDmitry Vyukov <dvyukov@google.com> Reviewed-by: NAndrei Vagin <avagin@gmail.com> Signed-off-by: N"Eric W. Biederman" <ebiederm@xmission.com>
040757f7