cr: credentials: fix some refcounting

index 5047944..74872ba 100644
@@ -601,7 +601,8 @@ static struct user_namespace *restore_read_userns(struct ckpt_ctx *ctx)
 		return ERR_PTR(PTR_ERR(h));
 	if (h->flags & CKPT_USERNS_INIT) {
 		ckpt_hdr_put(ctx, h);
-		return current_user_ns();
+		/* grab an extra ref bc objhash will drop an extra */
+		return get_user_ns(current_user_ns());
 	}
 	creator = ckpt_obj_fetch(ctx, h->creator_ref, CKPT_OBJ_USER);
 	ckpt_hdr_put(ctx, h);

@@ -616,6 +617,10 @@ static struct user_namespace *restore_read_userns(struct ckpt_ctx *ctx)
 	/* new_user_ns() doesn't bump creator's refcount */
 	get_uid(creator);
 
+	/* objhash will drop new_ns refcount, but new_root
+	 * should hold a ref */
+	get_user_ns(ns);
+
 	return ns;
 }
 

@@ -1088,6 +1093,10 @@ static int restore_creds(struct ckpt_ctx *ctx, struct cred *rcred,
 	int ret;
 	const struct cred *old;
 
+	/* commit_creds will take one ref for the eff creds, but
+	 * expects us to hold a ref for the obj creds, so take a
+	 * ref here */
+	get_cred(rcred);
 	ret = commit_creds(rcred);
 	if (ret)
 		return ret;