On 09/08, Eric W. Biederman wrote: > > Oleg Nesterov <o...@redhat.com> writes: > > > On 09/08, Oleg Nesterov wrote: > >> > >> Off topic. What if the first alloc_pid() succeeds and then later > >> copy_process() fails. In this case free_pid() is called but > >> PIDNS_HASH_ADDING was not cleared, we miss kern_unmount(), no? > > > > Perhaps something like below? > > I am thinking more: > > diff --git a/kernel/pid.c b/kernel/pid.c > index ab75add..ef59516 100644 > --- a/kernel/pid.c > +++ b/kernel/pid.c > @@ -273,6 +273,10 @@ void free_pid(struct pid *pid) > */ > wake_up_process(ns->child_reaper); > break; > + case PIDNS_HASH_ADDING: > + /* Handle a fork failure of the first process */ > + ns->nr_hashed = 0;
Agreed, it also makes sense to clear ->nr_hashed. But I still think that WARN_ON(ns->child_reaper) makes sense too. > At which point I ask myself what of the pathlogocical case where the > first fork fails but because we created the pid namespace with unshare > there is a concurrent fork from another process into the pid namespace > that succeeds. Resulting in one pid in the pid namespace that is not > the reaper. But how can setns() work before the first fork() succeeds and makes the ->child_reaper visible in /proc ? Probably I missed something obvious, I didn't sleep today... Oleg. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/