From 4e71e474c784dc274f28ec8bb22a5dbabc6dc7c5 Mon Sep 17 00:00:00 2001 From: Cedric Le Goater Date: Sat, 23 Jun 2007 17:16:25 -0700 Subject: fix refcounting of nsproxy object when unshared When a namespace is unshared, a refcount on the previous nsproxy is abusively taken, leading to a memory leak of nsproxy objects. Signed-off-by: Cedric Le Goater Cc: Badari Pulavarty Cc: Herbert Poetzl Cc: Oleg Nesterov Cc: "Eric W. Biederman" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- kernel/nsproxy.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) (limited to 'kernel') diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c index 1bc4b55241a8..9e83b589f754 100644 --- a/kernel/nsproxy.c +++ b/kernel/nsproxy.c @@ -145,13 +145,11 @@ void free_nsproxy(struct nsproxy *ns) /* * Called from unshare. Unshare all the namespaces part of nsproxy. - * On sucess, returns the new nsproxy and a reference to old nsproxy - * to make sure it stays around. + * On success, returns the new nsproxy. */ int unshare_nsproxy_namespaces(unsigned long unshare_flags, struct nsproxy **new_nsp, struct fs_struct *new_fs) { - struct nsproxy *old_ns = current->nsproxy; int err = 0; if (!(unshare_flags & (CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWIPC))) @@ -170,13 +168,9 @@ int unshare_nsproxy_namespaces(unsigned long unshare_flags, if (!capable(CAP_SYS_ADMIN)) return -EPERM; - get_nsproxy(old_ns); - *new_nsp = create_new_namespaces(unshare_flags, current, new_fs ? new_fs : current->fs); - if (IS_ERR(*new_nsp)) { + if (IS_ERR(*new_nsp)) err = PTR_ERR(*new_nsp); - put_nsproxy(old_ns); - } return err; } -- cgit v1.2.3-59-g8ed1b