Eric W. Biederman 040757f738 ucount: Remove the atomicity from ucount->count ... Always increment/decrement ucount->count under the ucounts_lock. The increments are there already and moving the decrements there means the locking logic of the code is simpler. This simplification in the locking logic fixes a race between put_ucounts and get_ucounts that could result in a use-after-free because the count could go zero then be found by get_ucounts and then be freed by put_ucounts. A bug presumably this one was found by a combination of syzkaller and KASAN. JongWhan Kim reported the syzkaller failure and Dmitry Vyukov spotted the race in the code. Cc: stable@vger.kernel.org Fixes: f6b2db1a3e ("userns: Make the count of user namespaces per user") Reported-by: JongHwan Kim <zzoru007@gmail.com> Reported-by: Dmitry Vyukov <dvyukov@google.com> Reviewed-by: Andrei Vagin <avagin@gmail.com> Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>		2017-03-06 15:26:37 -06:00
..
bpf	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-03-04 17:31:39 -08:00
cgroup	sched/headers: Remove <linux/magic.h> from <linux/sched/task_stack.h>	2017-03-03 01:45:39 +01:00
configs	config: android-base: enable hardened usercopy and kernel ASLR	2017-02-27 18:43:46 -08:00
debug	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/debug.h>	2017-03-02 08:42:34 +01:00
events	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task_stack.h>	2017-03-02 08:42:36 +01:00
gcov
irq	sched/headers: Prepare to move the get_task_struct()/put_task_struct() and related APIs from <linux/sched.h> to <linux/sched/task.h>	2017-03-02 08:42:40 +01:00
livepatch
locking	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task.h>	2017-03-02 08:42:35 +01:00
power	Merge branch 'WIP.sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2017-03-03 10:16:38 -08:00
printk	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task_stack.h>	2017-03-02 08:42:36 +01:00
rcu	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/debug.h>	2017-03-02 08:42:34 +01:00
sched	sched/headers: Move cputime functionality from <linux/sched.h> and <linux/cputime.h> into <linux/sched/cputime.h>	2017-03-03 01:45:22 +01:00
time	sched/headers: Prepare to move exit_files() and exit_itimers() from <linux/sched.h> to <linux/sched/task.h>	2017-03-02 08:42:40 +01:00
trace	sched/headers: Prepare to use <linux/rcuupdate.h> instead of <linux/rculist.h> in <linux/sched.h>	2017-03-02 08:42:38 +01:00
.gitignore
acct.c	sched/headers: Prepare to move cputime functionality from <linux/sched.h> into <linux/sched/cputime.h>	2017-03-02 08:42:39 +01:00
async.c
audit_fsnotify.c
audit_tree.c
audit_watch.c
audit.c	Merge branch 'stable-4.11' of git://git.infradead.org/users/pcmoore/audit	2017-02-21 13:25:50 -08:00
audit.h	Merge branch 'stable-4.11' of git://git.infradead.org/users/pcmoore/audit	2017-02-21 13:25:50 -08:00
auditfilter.c
auditsc.c	Merge branch 'stable-4.11' of git://git.infradead.org/users/pcmoore/audit	2017-02-21 13:25:50 -08:00
backtracetest.c
bounds.c
capability.c
compat.c
configs.c
context_tracking.c
cpu_pm.c
cpu.c	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task.h>	2017-03-02 08:42:35 +01:00
crash_dump.c
cred.c	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/coredump.h>	2017-03-02 08:42:28 +01:00
delayacct.c	sched/headers: Prepare to move cputime functionality from <linux/sched.h> into <linux/sched/cputime.h>	2017-03-02 08:42:39 +01:00
dma.c
elfcore.c
exec_domain.c
exit.c	sched/headers: Prepare to move cputime functionality from <linux/sched.h> into <linux/sched/cputime.h>	2017-03-02 08:42:39 +01:00
extable.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2017-02-22 10:15:09 -08:00
fork.c	sched/headers, RCU: Move rcu_copy_process() from <linux/sched/task.h> to kernel/fork.c	2017-03-03 01:43:46 +01:00
freezer.c
futex_compat.c
futex.c	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/mm.h>	2017-03-02 08:42:28 +01:00
groups.c
hung_task.c	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/debug.h>	2017-03-02 08:42:34 +01:00
irq_work.c
jump_label.c	This release has no new tracing features, just clean ups, minor fixes	2017-02-27 13:26:17 -08:00
kallsyms.c	bpf: make jited programs visible in traces	2017-02-17 13:40:05 -05:00
kcmp.c
Kconfig.freezer
Kconfig.hz
Kconfig.locks
Kconfig.preempt
kcov.c
kexec_core.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/pmladek/printk	2017-02-22 17:33:34 -08:00
kexec_file.c
kexec_internal.h
kexec.c
kmod.c	sched/headers, vfs/execve: Prepare to move the do_execve*() prototypes from <linux/sched.h> to <linux/binfmts.h>	2017-03-02 08:42:39 +01:00
kprobes.c	powerpc updates for 4.11 part 1.	2017-02-22 10:30:38 -08:00
ksysfs.c	kernel/ksysfs.c: add __ro_after_init to bin_attribute structure	2017-02-24 17:46:56 -08:00
kthread.c	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task.h>	2017-03-02 08:42:35 +01:00
latencytop.c	sched/headers: Prepare to move sched_info_on() and force_schedstat_enabled() from <linux/sched.h> to <linux/sched/stat.h>	2017-03-02 08:42:39 +01:00
Makefile
membarrier.c
memremap.c	mm, devm_memremap_pages: hold device_hotplug lock over mem_hotplug_{begin, done}	2017-02-24 17:46:53 -08:00
module_signing.c
module-internal.h
module.c	Modules updates for v4.11	2017-02-22 17:08:33 -08:00
notifier.c	kernel/notifier.c: simplify expression	2017-02-24 17:46:56 -08:00
nsproxy.c
padata.c
panic.c	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/debug.h>	2017-03-02 08:42:34 +01:00
params.c
pid_namespace.c	sched/headers: Prepare for the reduction of <linux/sched.h>'s signal API dependency	2017-03-02 08:42:37 +01:00
pid.c	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task.h>	2017-03-02 08:42:35 +01:00
profile.c	sched/headers: Prepare to move sched_info_on() and force_schedstat_enabled() from <linux/sched.h> to <linux/sched/stat.h>	2017-03-02 08:42:39 +01:00
ptrace.c	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task.h>	2017-03-02 08:42:35 +01:00
range.c
reboot.c
relay.c	lib/vsprintf.c: remove %Z support	2017-02-27 18:43:47 -08:00
resource.c
seccomp.c	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task_stack.h>	2017-03-02 08:42:36 +01:00
signal.c	sched/headers: Prepare to move cputime functionality from <linux/sched.h> into <linux/sched/cputime.h>	2017-03-02 08:42:39 +01:00
smp.c	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/idle.h>	2017-03-02 08:42:26 +01:00
smpboot.c	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task.h>	2017-03-02 08:42:35 +01:00
smpboot.h
softirq.c
stacktrace.c
stop_machine.c
sys_ni.c
sys.c	sched/headers: Prepare to move cputime functionality from <linux/sched.h> into <linux/sched/cputime.h>	2017-03-02 08:42:39 +01:00
sysctl_binary.c
sysctl.c	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/coredump.h>	2017-03-02 08:42:28 +01:00
task_work.c
taskstats.c
test_kprobes.c
torture.c	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/clock.h>	2017-03-02 08:42:27 +01:00
tracepoint.c	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task.h>	2017-03-02 08:42:35 +01:00
tsacct.c	sched/headers: Prepare to move cputime functionality from <linux/sched.h> into <linux/sched/cputime.h>	2017-03-02 08:42:39 +01:00
ucount.c	ucount: Remove the atomicity from ucount->count	2017-03-06 15:26:37 -06:00
uid16.c	sched/headers: Prepare to remove <linux/cred.h> inclusion from <linux/sched.h>	2017-03-02 08:42:31 +01:00
up.c
user_namespace.c	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/signal.h>	2017-03-02 08:42:29 +01:00
user-return-notifier.c
user.c	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/user.h>	2017-03-02 08:42:29 +01:00
utsname_sysctl.c	sched/headers: Remove <linux/rwsem.h> from <linux/sched.h>	2017-03-03 01:45:36 +01:00
utsname.c	sched/headers: Prepare to move the task_lock()/unlock() APIs to <linux/sched/task.h>	2017-03-02 08:42:38 +01:00
watchdog_hld.c	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/debug.h>	2017-03-02 08:42:34 +01:00
watchdog.c	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/debug.h>	2017-03-02 08:42:34 +01:00
workqueue_internal.h
workqueue.c	time: Remove CONFIG_TIMER_STATS	2017-02-10 11:15:08 +01:00