[Devel] [PATCH vz9] ve/userns: remove all hashed entries before freeing user_namespace

[Alexander Atanasov]

548df8b4b57b (ve/userns: associate user_struct with the user_namespace, 2017-03-13)
introduced dynamically allocated per-userns uid hastable
instead of using a global static hash table.

The problem with that allocate hashtable is that life cycle of
the two objects is different - both structes use reference
counts but they are counted separately. The contained objects
(user_struct) are not referenced from user_namespace.
The result of that is that on ve destroy last reference to
user_namespace is dropped and it is freed - the allocated
hash table is freed too.

But user_structs that were hashed can still be used elsewhere
(like on inodes), so when the reference to that structs is dropped
(evict_inodes) they try to remove from the hash which was alrady freed.
This results in writting a NULL to an already freed memory.
But since this happens after some time that write usually corrupts
some new allocation which results in a variety of crashes.

To fix this remove all user_structs that are still in the hash
when destroing user_namespace. The hash is used to lookup them
but since the user_namespace is gone no further lookups are possible.

https://jira.vzint.dev/browse/PSBM-150648
Signed-off-by: Alexander Atanasov <alexander.atanasov at virtuozzo.com>
---
 include/linux/sched/user.h |  1 +
 kernel/user.c              | 13 +++++++++++++
 kernel/user_namespace.c    |  3 +++
 3 files changed, 17 insertions(+)

diff --git a/include/linux/sched/user.h b/include/linux/sched/user.h
index f4c5bc54d62b..0f45e50f71a2 100644
--- a/include/linux/sched/user.h
+++ b/include/linux/sched/user.h
@@ -43,6 +43,7 @@ struct user_struct {
 extern int uids_sysfs_init(void);
 
 extern struct user_struct *find_user(kuid_t);
+extern void uid_hash_remove_all(struct hlist_head *hlist);
 
 extern struct user_struct root_user;
 #define INIT_USER (&root_user)
diff --git a/kernel/user.c b/kernel/user.c
index ca0f7c78a045..ea2b25293614 100644
--- a/kernel/user.c
+++ b/kernel/user.c
@@ -113,6 +113,19 @@ static void uid_hash_remove(struct user_struct *up)
 	hlist_del_init(&up->uidhash_node);
 }
 
+void uid_hash_remove_all(struct hlist_head *hlist)
+{
+	struct user_struct *up;
+	const struct hlist_node *tmp;
+	unsigned long flags;
+
+	spin_lock_irqsave(&uidhash_lock, flags);
+	if (!hlist_empty(hlist))
+		hlist_for_each_entry_safe(up, tmp, hlist, uidhash_node)
+			hlist_del_init(&up->uidhash_node);
+	spin_unlock_irqrestore(&uidhash_lock, flags);
+}
+
 static struct user_struct *uid_hash_find(kuid_t uid, struct hlist_head *hashent)
 {
 	struct user_struct *user;
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index e175452253d3..52e6bff36abf 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -205,6 +205,7 @@ static void free_user_ns(struct work_struct *work)
 {
 	struct user_namespace *parent, *ns =
 		container_of(work, struct user_namespace, work);
+	int i;
 
 	do {
 		struct ucounts *ucounts = ns->ucounts;
@@ -224,6 +225,8 @@ static void free_user_ns(struct work_struct *work)
 		retire_userns_sysctls(ns);
 		key_free_user_ns(ns);
 		ns_free_inum(&ns->ns);
+		for (i = 0; i < UIDHASH_SZ; ++i)
+			uid_hash_remove_all(ns->uidhash_table + i);
 		kmem_cache_free(user_ns_cachep, ns);
 		dec_user_namespaces(ucounts);
 		ns = parent;
-- 
2.39.3