| Message ID | 20160721164014.17534-5-ebiederm@xmission.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
Quoting Eric W. Biederman (ebiederm@xmission.com): > Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> Acked-by: Serge Hallyn <serge@hallyn.com> > --- > include/linux/user_namespace.h | 1 + > kernel/pid_namespace.c | 22 ++++++++++++++++++---- > kernel/user_namespace.c | 1 + > 3 files changed, 20 insertions(+), 4 deletions(-) > > diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h > index f74a0facc696..47733637741a 100644 > --- a/include/linux/user_namespace.h > +++ b/include/linux/user_namespace.h > @@ -24,6 +24,7 @@ struct uid_gid_map { /* 64 bytes -- 1 cache line */ > > enum ucounts { > UCOUNT_USER_NAMESPACES, > + UCOUNT_PID_NAMESPACES, > UCOUNT_COUNTS, > }; > > diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c > index a65ba137fd15..049cc14ae37a 100644 > --- a/kernel/pid_namespace.c > +++ b/kernel/pid_namespace.c > @@ -79,6 +79,16 @@ static void proc_cleanup_work(struct work_struct *work) > /* MAX_PID_NS_LEVEL is needed for limiting size of 'struct pid' */ > #define MAX_PID_NS_LEVEL 32 > > +static bool inc_pid_namespaces(struct user_namespace *ns) > +{ > + return inc_ucount(ns, UCOUNT_PID_NAMESPACES); > +} > + > +static void dec_pid_namespaces(struct user_namespace *ns) > +{ > + dec_ucount(ns, UCOUNT_PID_NAMESPACES); > +} > + > static struct pid_namespace *create_pid_namespace(struct user_namespace *user_ns, > struct pid_namespace *parent_pid_ns) > { > @@ -87,15 +97,16 @@ static struct pid_namespace *create_pid_namespace(struct user_namespace *user_ns > int i; > int err; > > - if (level > MAX_PID_NS_LEVEL) { > - err = -EINVAL; > + err = -EINVAL; > + if (level > MAX_PID_NS_LEVEL) > + goto out; > + if (!inc_pid_namespaces(user_ns)) > goto out; > - } > > err = -ENOMEM; > ns = kmem_cache_zalloc(pid_ns_cachep, GFP_KERNEL); > if (ns == NULL) > - goto out; > + goto out_dec; > > ns->pidmap[0].page = kzalloc(PAGE_SIZE, GFP_KERNEL); > if (!ns->pidmap[0].page) > @@ -129,6 +140,8 @@ out_free_map: > kfree(ns->pidmap[0].page); > out_free: > kmem_cache_free(pid_ns_cachep, ns); > +out_dec: > + dec_pid_namespaces(user_ns); > out: > return ERR_PTR(err); > } > @@ -146,6 +159,7 @@ static void destroy_pid_namespace(struct pid_namespace *ns) > ns_free_inum(&ns->ns); > for (i = 0; i < PIDMAP_ENTRIES; i++) > kfree(ns->pidmap[i].page); > + dec_pid_namespaces(ns->user_ns); > put_user_ns(ns->user_ns); > call_rcu(&ns->rcu, delayed_free_pidns); > } > diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c > index 728d7e4995ff..02a03ead7afc 100644 > --- a/kernel/user_namespace.c > +++ b/kernel/user_namespace.c > @@ -77,6 +77,7 @@ static int count_max = COUNT_MAX; > } > static struct ctl_table userns_table[] = { > UCOUNT_ENTRY("max_user_namespaces"), > + UCOUNT_ENTRY("max_pid_namespaces"), > { } > }; > #endif /* CONFIG_SYSCTL */ > -- > 2.8.3 -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h index f74a0facc696..47733637741a 100644 --- a/include/linux/user_namespace.h +++ b/include/linux/user_namespace.h @@ -24,6 +24,7 @@ struct uid_gid_map { /* 64 bytes -- 1 cache line */ enum ucounts { UCOUNT_USER_NAMESPACES, + UCOUNT_PID_NAMESPACES, UCOUNT_COUNTS, }; diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c index a65ba137fd15..049cc14ae37a 100644 --- a/kernel/pid_namespace.c +++ b/kernel/pid_namespace.c @@ -79,6 +79,16 @@ static void proc_cleanup_work(struct work_struct *work) /* MAX_PID_NS_LEVEL is needed for limiting size of 'struct pid' */ #define MAX_PID_NS_LEVEL 32 +static bool inc_pid_namespaces(struct user_namespace *ns) +{ + return inc_ucount(ns, UCOUNT_PID_NAMESPACES); +} + +static void dec_pid_namespaces(struct user_namespace *ns) +{ + dec_ucount(ns, UCOUNT_PID_NAMESPACES); +} + static struct pid_namespace *create_pid_namespace(struct user_namespace *user_ns, struct pid_namespace *parent_pid_ns) { @@ -87,15 +97,16 @@ static struct pid_namespace *create_pid_namespace(struct user_namespace *user_ns int i; int err; - if (level > MAX_PID_NS_LEVEL) { - err = -EINVAL; + err = -EINVAL; + if (level > MAX_PID_NS_LEVEL) + goto out; + if (!inc_pid_namespaces(user_ns)) goto out; - } err = -ENOMEM; ns = kmem_cache_zalloc(pid_ns_cachep, GFP_KERNEL); if (ns == NULL) - goto out; + goto out_dec; ns->pidmap[0].page = kzalloc(PAGE_SIZE, GFP_KERNEL); if (!ns->pidmap[0].page) @@ -129,6 +140,8 @@ out_free_map: kfree(ns->pidmap[0].page); out_free: kmem_cache_free(pid_ns_cachep, ns); +out_dec: + dec_pid_namespaces(user_ns); out: return ERR_PTR(err); } @@ -146,6 +159,7 @@ static void destroy_pid_namespace(struct pid_namespace *ns) ns_free_inum(&ns->ns); for (i = 0; i < PIDMAP_ENTRIES; i++) kfree(ns->pidmap[i].page); + dec_pid_namespaces(ns->user_ns); put_user_ns(ns->user_ns); call_rcu(&ns->rcu, delayed_free_pidns); } diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c index 728d7e4995ff..02a03ead7afc 100644 --- a/kernel/user_namespace.c +++ b/kernel/user_namespace.c @@ -77,6 +77,7 @@ static int count_max = COUNT_MAX; } static struct ctl_table userns_table[] = { UCOUNT_ENTRY("max_user_namespaces"), + UCOUNT_ENTRY("max_pid_namespaces"), { } }; #endif /* CONFIG_SYSCTL */
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> --- include/linux/user_namespace.h | 1 + kernel/pid_namespace.c | 22 ++++++++++++++++++---- kernel/user_namespace.c | 1 + 3 files changed, 20 insertions(+), 4 deletions(-)