nsproxy: strengthen the comment above copy_namespaces

copy_namespaces() cannot be used on a live task. There are two reasons - it can be used to assign another task's nsproxy, which is not legal (for a live task). And, it does not use rcu_assign_pointer, so even when we're being extra-clever it is unsafe.

Signed-off-by Serge Hallyn <serue-r/[email protected]>

---
 kernel/nsproxy.c |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)

kernel/nsproxy.c +3 -0

index f74e6c0..67d8f2b 100644
@@ -115,6 +115,9 @@ out_ns:
 /*
  * called from clone.  This now handles copy for nsproxy and all
  * namespaces therein.
+ * Note this should only be used in fork.  Specifically, tsk should
+ * not yet be a live task.  See the the unshare code for how to handle
+ * that.
  */
 int copy_namespaces(unsigned long flags, struct task_struct *tsk)
 {

Serge -

Is this intended for linux-cr ?
Sounds like it should go (or already?) upstream.

Oren.

Quoted 16 lines · Serge E. Hallyn

copy_namespaces() cannot be used on a live task. There are two reasons - it can be used to assign another task's nsproxy, which is not legal (for a live task). And, it does not use rcu_assign_pointer, so even when we're being extra-clever it is unsafe.

Signed-off-by Serge Hallyn <serue-r/[email protected]>

---
 kernel/nsproxy.c |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)

kernel/nsproxy.c +0 -0

index f74e6c0..67d8f2b 100644

kernel/nsproxy.c out_ns: · line 123

Quoted 9 lines

kernel/nsproxy.c +3 -0

@@ -115,6 +115,9 @@ out_ns:
 /*
  * called from clone.  This now handles copy for nsproxy and all
  * namespaces therein.
+ * Note this should only be used in fork.  Specifically, tsk should
+ * not yet be a live task.  See the the unshare code for how to handle
+ * that.
  */
 int copy_namespaces(unsigned long flags, struct task_struct *tsk)
 {

_______________________________________________
Containers mailing list Containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org
https://lists.linux-foundation.org/mailman/listinfo/containers