From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6B9C7C433EF for ; Sun, 10 Oct 2021 08:59:20 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id BA43461039 for ; Sun, 10 Oct 2021 08:59:19 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org BA43461039 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=infomedia.dk Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kvack.org Received: by kanga.kvack.org (Postfix) id E82F86B006C; Sun, 10 Oct 2021 04:59:18 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id E32F8900002; Sun, 10 Oct 2021 04:59:18 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id CD39C6B0073; Sun, 10 Oct 2021 04:59:18 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0243.hostedemail.com [216.40.44.243]) by kanga.kvack.org (Postfix) with ESMTP id BB3A06B006C for ; Sun, 10 Oct 2021 04:59:18 -0400 (EDT) Received: from smtpin12.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id 56453181AEF0B for ; Sun, 10 Oct 2021 08:59:18 +0000 (UTC) X-FDA: 78679928796.12.5F69A38 Received: from EUR04-HE1-obe.outbound.protection.outlook.com (mail-eopbgr70121.outbound.protection.outlook.com [40.107.7.121]) by imf13.hostedemail.com (Postfix) with ESMTP id A1FA2103DD08 for ; Sun, 10 Oct 2021 08:59:17 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ZPDnhYj+akDfRsqdXzh5AT+TSAgQZDAHFLW9YSneQzs2Sm39+jDpfuwVNVCBbq2a/XuZzhxkxHmrqQ8Ynll78PcuyRAKjCgS1FLBypt2cX9deSpLjtdIcmmmOvwSpx0GERWSCyLrNsFJ7cpA08R1N6L2DZaukOGcO07p35NSWhFNynHWyqcSBQEP9kJSABqbxN6/bUeUnJn7D6kU6ShiWgHICjiJKSxhPfyF7Aw45b7kpxrnQGGivfMk1iiCr2zfbYa0Z7gjMsrQrngf3QkuuXBFurz0I2f/xGSk/0qNFb/g7JTxvT1DBhbk/phSp+c+kuefyilk86urfqU9etFZVg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=E58SpxdQy1hz+2DNz+ciUlvtlRoT02DwGwueZVrT3SE=; b=QdJ/oSqUP0decmNC9TpKuHjJ+CSYpNVrC/rkjSGnm18BlF7hY52J4je3sl8+znBwRAOThm/gQiuK0RN8qqp7Al0JguDKIW08eu5bWvLnqJ6OaCc/sPJucoElA6qGehnBT+lt3CkJXeVJkUFRqJFWYfGO6Ks9cySTcz/l74yfWAIDDh05NZKrZjlI5qN5CWRWo+FemNMvhA/yCJ/OPVUkAGkoozI54HgAng0lkpCR6tMwTWPjKbmNOzWI21d8+ScSCtC3rYqja0TEw/v7gLoNmMYS1SBBqRcfKEEcFgFdn6FUxkql9T5e41dlvo3n7sDKpn3XKWqDdI+OjF6ncbgrYg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=infomedia.dk; dmarc=pass action=none header.from=infomedia.dk; dkim=pass header.d=infomedia.dk; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=infomedia.dk; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=E58SpxdQy1hz+2DNz+ciUlvtlRoT02DwGwueZVrT3SE=; b=ZH9g1VRoDTX8nYIa9v+3vUyS4aV62oQgDUA36KunFAHEXdTs0fH+F6Ykpx5+h08etCZ7FP+aeNb19Ct0GMZ7KkxHuEn33cK2PAHb1k9+Pj3VjF28xDJfJWCKI5NEtPBtSJEHQWM7HVoDCbqlSNKrFU+7DSUPSQtY/PP4OZQqXu8= Received: from PA4PR06MB7263.eurprd06.prod.outlook.com (2603:10a6:102:f7::10) by PAXPR06MB8128.eurprd06.prod.outlook.com (2603:10a6:102:1ac::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4587.20; Sun, 10 Oct 2021 08:59:13 +0000 Received: from PA4PR06MB7263.eurprd06.prod.outlook.com ([fe80::428:6cd1:2d65:4314]) by PA4PR06MB7263.eurprd06.prod.outlook.com ([fe80::428:6cd1:2d65:4314%7]) with mapi id 15.20.4587.025; Sun, 10 Oct 2021 08:59:13 +0000 Message-ID: Date: Sun, 10 Oct 2021 10:59:10 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.1.0 Subject: Re: linux 5.14.3: free_user_ns causes NULL pointer dereference Content-Language: en-US To: "Eric W. Biederman" , Yu Zhao Cc: Alexey Gladkov , Jordan Glover , LKML , linux-mm@kvack.org, containers@lists.linux-foundation.org References: <1M9_d6wrcu6rdPe1ON0_k0lOxJMyyot3KAb1gdyuwzDPC777XVUWPHoTCEVmcK3fYfgu7sIo3PSaLe9KulUdm4TWVuqlbKyYGxRAjsf_Cpk=@protonmail.ch> <87ee9pa6xw.fsf@disp2133> <878rzw77i3.fsf@disp2133> <20210929173611.fo5traia77o63gpw@example.org> <20210930130640.wudkpmn3cmah2cjz@example.org> <878rz8wwb6.fsf@disp2133> <87v92cvhbf.fsf@disp2133> From: Rune Kleveland In-Reply-To: <87v92cvhbf.fsf@disp2133> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-ClientProxiedBy: OL1P279CA0011.NORP279.PROD.OUTLOOK.COM (2603:10a6:e10:12::16) To PA4PR06MB7263.eurprd06.prod.outlook.com (2603:10a6:102:f7::10) MIME-Version: 1.0 Received: from [192.168.1.102] (84.212.50.24) by OL1P279CA0011.NORP279.PROD.OUTLOOK.COM (2603:10a6:e10:12::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4587.25 via Frontend Transport; Sun, 10 Oct 2021 08:59:12 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 4fbe5276-abb2-493c-2ea3-08d98bcc3b21 X-MS-TrafficTypeDiagnostic: PAXPR06MB8128: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:10000; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: Ku5VinhMvWWXSI10A7ZEFUOyEyEksxBO5KoOS+TkMbSInr/nWrjfkyFiszKgU643INuk3O13GpqcXZwZudt7lt7skp7tebwUQnN6J83LD0oL2pMMbz6kUN1Ig0ZrtDs/4p9f+vO3vKFTxrMHfb+K64t9twoq4MABmPmS8Cw3zhRJnM+no7Andq452l3kSMrzWvgdi8LpioqmueqmpkxfE2kNoAhynMkH3nX8kWdai7cCka+NGZoIvxo6CVXNVlgCR5gj1tT3HCX1h9ICEqbttYaA5+NvqJ8np/zzmSWzFJoqPyFMA4lYchKw/ToP0pj3h7fzZhUxelgbTh+p8khlMCdRcSYhpxxC/BbFkJKUS/GFhteoOkNLyKHifipr9hPKsjvN5NM3yP3peI1PPJrkoS9d3XdGWamoIZtPP2ootpAF3U8UBG5L3cPj6mRJe9hhV3tzyJ46BUF5WrIqaCx8cm2LvDNWP0m2MrsYvHmj92Z/oOpwgAELr8i28s1kYujt0lZVd+dfjNq3CpStSRnHqlldTIkLzyxddfSdoE2H2km4ASn0hYg/kUCqTj4tJ23k6eGepGRpF+6jwgrz67oZ07tCAGXp31n9WNvgWxBdkJJI0D6fktvoOR2hhQx6g29FGYX9P2NRrsca+8PDDf2y6CIVySCf56pYlI8YzlhbSg/VDT2yHsT5CZxKt1m+dD2HFgl2UhZZRVcEgX7q2hT9AE8VKDmwlkOxBgCQeg1L44xa+xm5VdcI4TZ56jwmFgh2fSqJYYFk3hW9VawoOTIm3w== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:PA4PR06MB7263.eurprd06.prod.outlook.com;PTR:;CAT:NONE;SFS:(396003)(366004)(376002)(136003)(346002)(39840400004)(36756003)(31686004)(38100700002)(38350700002)(316002)(16576012)(26005)(5660300002)(2906002)(186003)(66556008)(66476007)(66946007)(2616005)(8936002)(956004)(53546011)(8676002)(8976002)(31696002)(54906003)(508600001)(52116002)(86362001)(44832011)(6486002)(4326008)(110136005)(45080400002)(83380400001)(45980500001)(43740500002);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?MWo2RGgydmJuTzFmKzdDRlMvaEFKVzd1MXZyeWdXVjdpNU1HWlUwZGpuWWxv?= =?utf-8?B?UW9Gb1FLajhIMnhDZGtNRUVZcDZWT0k1aDVxNUcxVXA4c01XeWY4Yk1RbmNI?= =?utf-8?B?cFQxUEhObnJlcHBqUTI2Rm5JWlVUZy96UVExOWttZldQMWp3emt3UDRUTXAx?= =?utf-8?B?Mmk4SDlnV1JqcnJUTi8xd0hlS1NJZGlJb0UvaDM0VHpRYVlRZ1o3NWQxL3NR?= =?utf-8?B?TDJxOVdISDExaGlwYlM5SHY0MTBkNGtOVXJlaEFTY3pUOS9DZWtzdEtsWWJD?= =?utf-8?B?TlMvaFdyT213cGhRbktZL0NtMGM5OHFvV01CTExDY0pQaGY3MWZDZW0zYnBO?= =?utf-8?B?NjI1R1RLamVUYjdOT2JVV3RISytlTy9JdWFTNVZQSlRvREY2TFI4MFE3R0w0?= =?utf-8?B?UEF3UFBsOG85WjkyK0ZFTzBIUGJGckhXZGN4S3BtQmpuSDMyeE9GZk0vWnpJ?= =?utf-8?B?cmY3Wmh1OURpKzhHUExPY2dFaTRLd1UwbnhrL0FCZGRCRG5Hdi8reHdYNzVR?= =?utf-8?B?NDVxRVpQV3VWWENvNHdsclYrcWFNRTlWbndiRTRXVHBzc0ZSUk5VWU1mMUY3?= =?utf-8?B?Rk1Cblp6RTJhOEJvVUk5bDNyMTVUL1N3Q0Nmcmk1Mk5mNVNDYXJGZnpEUEZl?= =?utf-8?B?RnpVNUNHOFlMTllrb01hamtoenVRbE1HMm5weXc2dUh1NWc3bjlpMlc2TUJ1?= =?utf-8?B?YTR5NEVwMk5WMGpXblR0L2lOZUlRN29IK2VlWlMyNVUwZE1wcW9vdG1GdHFp?= =?utf-8?B?L2ZrRGNpQndZUHFHQVZ3ZVlaOGFUdG5ZK05ZdHNySUN3N0JUQThmTXpzOGNt?= =?utf-8?B?T25Ya04wd0VTUmh0UU9wL3puZjdoQVlQUk9lc0R0MU9EOEV5TDE5WTFhMDg0?= =?utf-8?B?TzY2R0FBbitLSEoreFBJcUJTSlBLempoa0RmcUw1WDdWZ09WNmtIM292VEFu?= =?utf-8?B?aXdBcmhjWXFOck9sNFpkMktPZ2Jmc3ByK29pNVRlSU4yN3NlRWh5VFY2eWVI?= =?utf-8?B?aVpUT0w5Z292eEd5eExSWHdmbFJDWDJmQXN3NnExVVV1OHVnQVB2eCtmc3VV?= =?utf-8?B?a1NBTWJhSkU1cUdwMFdrNFpSZmZTeXF2ZVhlb0JoUWlmdUFtd3dQS2pNZU4y?= =?utf-8?B?TWl5U2VHZklocDgyWEdLajFEZ1Vua1VueFREdjFrclR5SmhkVGJVY1NtK0Qr?= =?utf-8?B?bUhFSmdFbDNaUmhDYUFtai9TVVFEQjJMYzB1UGg5VTl5RDg3bExLTThPcWo4?= =?utf-8?B?eXY1MmdHRWpldzBNQ3Z1YW5ReHNHUXVHSWkyWHdtSHBNMUpxZDFRZGVyaVVL?= =?utf-8?B?eHpBYmY4c01yZTNRZkIybUhta0o3NGVhUTFCd1JnZEllYmI5RkZiZkJ0eTlt?= =?utf-8?B?YmVHNUpvYWZNMEpsbnVnV2lPMXZQaGVSUC9vWnprVU04NzZwSUlYTjZPbWdW?= =?utf-8?B?YjBJV2doU0tpdlk3STNJdUJmWHJpSjFaTnkwTlA5VkpIcFBranY0eGdYdkVO?= =?utf-8?B?eDd5MllEQk4wZFJRZUdvQ3c0eHRvOHpZUEJmeEhsNGZJZ2FLMDc2Yis2cE9H?= =?utf-8?B?WUI0Tmg0M0NDdHdRYVBWTTJWeGVVZzdJbHBYRThQbzhBZERYSXBVWDFjdFhD?= =?utf-8?B?VUxCTk96RWV5dHAvYU1rRUNyaEw3c0dCN3A2UGdpK0xWQlZWNXk4eHpBMENI?= =?utf-8?B?bjFiSlE1c25RSnlRY1dsT01RdWI5YlZpQmhNNFJ5T2kzOCtGYXBjckppanh1?= =?utf-8?Q?bMfuzSiKqx1+bflgdlAex/uEcc76701+zqN2XkA?= X-OriginatorOrg: infomedia.dk X-MS-Exchange-CrossTenant-Network-Message-Id: 4fbe5276-abb2-493c-2ea3-08d98bcc3b21 X-MS-Exchange-CrossTenant-AuthSource: PA4PR06MB7263.eurprd06.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Oct 2021 08:59:13.2639 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: e66074a4-dad5-454c-8f0e-f55dc95f5919 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 0K6GYT68+/MFODYdJFUTVI36yC2qLIl4+nTbd1cvbVz9Er9nTyspGR0zdhvAA1RMJzTn38mC5/tsVYObd0+rDhH3senDz3xG1mR2aW2Lqa0= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PAXPR06MB8128 X-Rspamd-Queue-Id: A1FA2103DD08 X-Stat-Signature: 7mytionepyedhz17c56rwqsza85jytwe Authentication-Results: imf13.hostedemail.com; dkim=pass header.d=infomedia.dk header.s=selector2 header.b=ZH9g1VRo; spf=pass (imf13.hostedemail.com: domain of Rune.Kleveland@infomedia.dk designates 40.107.7.121 as permitted sender) smtp.mailfrom=Rune.Kleveland@infomedia.dk; dmarc=pass (policy=none) header.from=infomedia.dk X-Rspamd-Server: rspam06 X-HE-Tag: 1633856357-359634 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Hi! Just wanted to let you know that I still get these on stock Fedora kernel 5.14.10 on the IBM blades. But it took 10 hours before the first server crashed. The other 4 still runs fine since 15 hours ago. So for me it seems more stable now, but that could just be a coincidence. Best regards, Rune ------------[ cut here ]------------ kernel BUG at mm/slub.c:321! invalid opcode: 0000 [#1] SMP PTI CPU: 22 PID: 1838853 Comm: python3 Not tainted 5.14.10-200.fc34.x86_64 #1 Hardware name: IBM BladeCenter HS22 -[7870TKN]-/68Y8161, BIOS -[P9E164CUS-1.28]- 04/17/2018 RIP: 0010:__slab_free+0x245/0x4a0 Code: 0f b6 5c 24 1b 44 8b 44 24 1c 48 89 44 24 08 48 8b 54 24 20 4c 8b 4c 24 28 e9 8a fe ff ff 41 f7 45 08 00 0d 21 00 75 98 eb 8d <0f> 0b 49 3b 54 24 28 0f 85 53 ff ff ff 49 8b 44 24 08 4> RSP: 0018:ffffb71dcfd6fda0 EFLAGS: 00010246 RAX: ffff9c5480d35860 RBX: ffff9c5480d35800 RCX: ffff9c5480d35800 RDX: 00000000802a0029 RSI: ffffeb41da034d00 RDI: ffff9c4f00042800 RBP: ffffb71dcfd6fe50 R08: 0000000000000001 R09: ffffffff9210b6a5 R10: ffff9c548102e000 R11: 0000000062667658 R12: ffffeb41da034d00 R13: ffff9c4f00042800 R14: ffff9c5480d35800 R15: ffff9c5480d35800 FS:  00007f7a89765740(0000) GS:ffff9c6c1fc80000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7a7ad7f4b0 CR3: 0000000564af4002 CR4: 00000000000206e0 Call Trace:  ? filename_lookup+0x135/0x1b0  ? put_ucounts+0x65/0x70  kfree+0x369/0x3c0  put_ucounts+0x65/0x70  put_cred_rcu+0x70/0xd0  do_faccessat+0x113/0x240  do_syscall_64+0x3b/0x90  entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f7a899cc44b Code: 77 05 c3 0f 1f 40 00 48 8b 15 29 1a 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff c3 0f 1f 40 00 f3 0f 1e fa b8 15 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 8b 15 f9 19 0> RSP: 002b:00007ffd01fa9ce8 EFLAGS: 00000202 ORIG_RAX: 0000000000000015 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f7a899cc44b RDX: 0000000000000000 RSI: 0000000000000001 RDI: 00007f79a96d6e10 RBP: 0000000000000001 R08: 0000000000000000 R09: 00007f7a7c1fb930 R10: 00007f79a96d6000 R11: 0000000000000202 R12: 00007ffd01fa9d00 R13: 0000000000000001 R14: 0000556841045c90 R15: 00000000ffffff9c Modules linked in: rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace sunrpc fscache netfs nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_rejec> ---[ end trace 0a81b150eacde1d5 ]--- RIP: 0010:__slab_free+0x245/0x4a0 Code: 0f b6 5c 24 1b 44 8b 44 24 1c 48 89 44 24 08 48 8b 54 24 20 4c 8b 4c 24 28 e9 8a fe ff ff 41 f7 45 08 00 0d 21 00 75 98 eb 8d <0f> 0b 49 3b 54 24 28 0f 85 53 ff ff ff 49 8b 44 24 08 4> RSP: 0018:ffffb71dcfd6fda0 EFLAGS: 00010246 RAX: ffff9c5480d35860 RBX: ffff9c5480d35800 RCX: ffff9c5480d35800 RDX: 00000000802a0029 RSI: ffffeb41da034d00 RDI: ffff9c4f00042800 RBP: ffffb71dcfd6fe50 R08: 0000000000000001 R09: ffffffff9210b6a5 R10: ffff9c548102e000 R11: 0000000062667658 R12: ffffeb41da034d00 R13: ffff9c4f00042800 R14: ffff9c5480d35800 R15: ffff9c5480d35800 FS:  00007f7a89765740(0000) GS:ffff9c6c1fc80000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7a7ad7f4b0 CR3: 0000000564af4002 CR4: 00000000000206e0 ------------[ cut here ]------------ On 04/10/2021 19:19, Eric W. Biederman wrote: > ebiederm@xmission.com (Eric W. Biederman) writes: > >> Adding Rune Kleveland to the discussion as he also seems to have >> reproduced the issue. >> >> Alex and I have been starring at the code and the reports and this >> bug is hiding well. Here is what we have figured out so far. >> >> Both the warning from free_user_ns calling dec_ucount that Jordan Glover >> reported and the KASAN error that Yu Zhao has reported appear to have >> the same cause. Using a ucounts structure after it has been freed and >> reallocated as something else. >> >> I have just skimmed through the recent report from Rune Kleveland >> and it appears also to be a use after free. Especially since the >> second failure in the log is slub complaining about trying to free >> the ucounts data structure. >> >> We looked through the users of put_ucounts and we don't see any obvious >> buggy users that would be freeing the data structure early. >> >> Alex has tried to reproduce this so far is not having any luck. >> Folks can you tell what compiler versions you are using and share your >> kernel config with us? That might help. >> >> The little debug diff below is my guess of what is happening. If the >> folks who can reproduce this issue can try the patch below and let me >> know if the warnings fire that would be appreciated. It is still not >> enough to track down the bug but at least it will confirm my current >> hypothesis about how things look before there is a use of memory after >> it is freed. > Bah. Scratch that test patch. I just double checked myself and > cred->ucounts and cred->user_ns->ucounts should never be equal, > as the user namespace is counted in it's parent user namespace. > > That observation now tells me I have a parent user namespace that went > corrupt. > > Back to the drawing board. > > >> Thank you, >> Eric >> >> diff --git a/kernel/cred.c b/kernel/cred.c >> index f784e08c2fbd..e7ffaa3cf5a6 100644 >> --- a/kernel/cred.c >> +++ b/kernel/cred.c >> @@ -120,6 +120,12 @@ static void put_cred_rcu(struct rcu_head *rcu) >> if (cred->group_info) >> put_group_info(cred->group_info); >> free_uid(cred->user); >> +#if 1 >> + if ((cred->ucounts == cred->user_ns->ucounts) && >> + (atomic_read(&cred->ucounts->count) == 1)) { >> + WARN_ONCE(1, "put_cred_rcu: ucount count 1\n"); >> + } >> +#endif >> if (cred->ucounts) >> put_ucounts(cred->ucounts); >> put_user_ns(cred->user_ns); >> diff --git a/kernel/exit.c b/kernel/exit.c >> index 91a43e57a32e..60fd88b34c1a 100644 >> --- a/kernel/exit.c >> +++ b/kernel/exit.c >> @@ -743,6 +743,13 @@ void __noreturn do_exit(long code) >> if (unlikely(!tsk->pid)) >> panic("Attempted to kill the idle task!"); >> >> +#if 1 >> + if ((tsk->cred->ucounts == tsk->cred->user_ns->ucounts) && >> + (atomic_read(tsk->cred->ucounts->count) == 1)) { >> + WARN_ONCE(1, "do_exit: ucount count 1\n"); >> + } >> +#endif >> + >> /* >> * If do_exit is called because this processes oopsed, it's possible >> * that get_fs() was left as KERNEL_DS, so reset it to USER_DS before