mqueue: Explicitly capture the user namespace to send the notification to.

Stop relying on user->user_ns which is going away and instead capture
the user_namespace of the process we are supposed to notify.

Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>

diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index 28bd64ddeda3f438742d5297e13da0269ad62609..b53cf3469d01b16d790fd6ebacf5cb0998241aad 100644 (file)
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -66,6 +66,7 @@ struct mqueue_inode_info {
 
        struct sigevent notify;
        struct pid* notify_owner;
+       struct user_namespace *notify_user_ns;
        struct user_struct *user;       /* user who created, for accounting */
        struct sock *notify_sock;
        struct sk_buff *notify_cookie;
@@ -139,6 +140,7 @@ static struct inode *mqueue_get_inode(struct super_block *sb,
                INIT_LIST_HEAD(&info->e_wait_q[0].list);
                INIT_LIST_HEAD(&info->e_wait_q[1].list);
                info->notify_owner = NULL;
+               info->notify_user_ns = NULL;
                info->qsize = 0;
                info->user = NULL;      /* set when all is ok */
                memset(&info->attr, 0, sizeof(info->attr));
@@ -536,7 +538,7 @@ static void __do_notify(struct mqueue_inode_info *info)
                        rcu_read_lock();
                        sig_i.si_pid = task_tgid_nr_ns(current,
                                                ns_of_pid(info->notify_owner));
-                       sig_i.si_uid = user_ns_map_uid(info->user->user_ns,
+                       sig_i.si_uid = user_ns_map_uid(info->notify_user_ns,
                                                current_cred(), current_uid());
                        rcu_read_unlock();
 
@@ -550,7 +552,9 @@ static void __do_notify(struct mqueue_inode_info *info)
                }
                /* after notification unregisters process */
                put_pid(info->notify_owner);
+               put_user_ns(info->notify_user_ns);
                info->notify_owner = NULL;
+               info->notify_user_ns = NULL;
        }
        wake_up(&info->wait_q);
 }
@@ -575,7 +579,9 @@ static void remove_notification(struct mqueue_inode_info *info)
                netlink_sendskb(info->notify_sock, info->notify_cookie);
        }
        put_pid(info->notify_owner);
+       put_user_ns(info->notify_user_ns);
        info->notify_owner = NULL;
+       info->notify_user_ns = NULL;
 }
 
 static int mq_attr_ok(struct ipc_namespace *ipc_ns, struct mq_attr *attr)
@@ -1140,6 +1146,7 @@ retry:
                }
 
                info->notify_owner = get_pid(task_tgid(current));
+               info->notify_user_ns = get_user_ns(current_user_ns());
                inode->i_atime = inode->i_ctime = CURRENT_TIME;
        }
        spin_unlock(&info->lock);