tree c86f225e8256d28271acf3ea8926e70358f3e5c1
parent bcf58e725ddc45d31addbc6627d4f0edccc824c1
author Eric W. Biederman <ebiederm@xmission.com> 1343304321 -0700
committer Eric W. Biederman <ebiederm@xmission.com> 1353413864 -0800

userns: Kill task_user_ns

The task_user_ns function hides the fact that it is getting the user
namespace from struct cred on the task.  struct cred may go away as
soon as the rcu lock is released.  This leads to a race where we
can dereference a stale user namespace pointer.

To make it obvious a struct cred is involved kill task_user_ns.

To kill the race modify the users of task_user_ns to only
reference the user namespace while the rcu lock is held.

Cc: Kees Cook <keescook@chromium.org>
Cc: James Morris <james.l.morris@oracle.com>
Acked-by: Kees Cook <keescook@chromium.org>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>