When a namespace is unshared, a refcount on the previous nsproxy is abusively taken, leading to a memory leak of nsproxy objects.
Showing the changes to kernel (1 of 1 file). Show all
Unified · Split
| @@ -145,13 +145,11 @@ void free_nsproxy(struct nsproxy *ns) · 144 unmodified lines | ||
| 145 | 145 | |
| 146 | 146 | /* |
| 147 | 147 | * Called from unshare. Unshare all the namespaces part of nsproxy. |
| 148 | − * On sucess, returns the new nsproxy and a reference to old nsproxy | |
| 149 | − * to make sure it stays around. | |
| 148 | + * On success, returns the new nsproxy. | |
| 150 | 149 | */ |
| 151 | 150 | int unshare_nsproxy_namespaces(unsigned long unshare_flags, |
| 152 | 151 | struct nsproxy **new_nsp, struct fs_struct *new_fs) |
| 153 | 152 | { |
| 154 | − struct nsproxy *old_ns = current->nsproxy; | |
| 155 | 153 | int err = 0; |
| 156 | 154 | |
| 157 | 155 | if (!(unshare_flags & (CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWIPC))) |
| @@ -170,13 +168,9 @@ int unshare_nsproxy_namespaces(unsigned long unshare_flags, · 12 unmodified lines | ||
| 170 | 168 | if (!capable(CAP_SYS_ADMIN)) |
| 171 | 169 | return -EPERM; |
| 172 | 170 | |
| 173 | − get_nsproxy(old_ns); | |
| 174 | − | |
| 175 | 171 | *new_nsp = create_new_namespaces(unshare_flags, current, |
| 176 | 172 | new_fs ? new_fs : current->fs); |
| 177 | − if (IS_ERR(*new_nsp)) { | |
| 173 | + if (IS_ERR(*new_nsp)) | |
| 178 | 174 | err = PTR_ERR(*new_nsp); |
| 179 | − put_nsproxy(old_ns); | |
| 180 | − } | |
| 181 | 175 | return err; |
| 182 | 176 | } |