3 files changed, 8 insertions, 8 deletions

diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h
index faf467944baf..dc2d85a76376 100644
--- a/include/linux/user_namespace.h
+++ b/include/linux/user_namespace.h
@@ -12,6 +12,7 @@
 struct user_namespace {
         struct kref             kref;
         struct hlist_head       uidhash_table[UIDHASH_SZ];
+        struct user_namespace   *parent;
         struct user_struct      *creator;
         struct work_struct      destroyer;
 };
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index 58bb8781a778..c15e533d6bc5 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -45,6 +45,7 @@ int create_user_ns(struct cred *new)
         }
 
         /* set the new root user in the credentials under preparation */
+        ns->parent = parent_ns;
         ns->creator = new->user;
         new->user = root_user;
         new->uid = new->euid = new->suid = new->fsuid = 0;
@@ -60,8 +61,6 @@ int create_user_ns(struct cred *new)
         /* Leave the reference to our user_ns with the new cred */
         new->user_ns = ns;
 
-        put_user_ns(parent_ns);
-
         return 0;
 }
 
@@ -72,10 +71,12 @@ int create_user_ns(struct cred *new)
  */
 static void free_user_ns_work(struct work_struct *work)
 {
-        struct user_namespace *ns =
+        struct user_namespace *parent, *ns =
                 container_of(work, struct user_namespace, destroyer);
+        parent = ns->parent;
         free_uid(ns->creator);
         kmem_cache_free(user_ns_cachep, ns);
+        put_user_ns(parent);
 }
 
 void free_user_ns(struct kref *kref)
@@ -99,8 +100,7 @@ uid_t user_ns_map_uid(struct user_namespace *to, const struct cred *cred, uid_t
         /* Is cred->user the creator of the target user_ns
          * or the creator of one of it's parents?
          */
-        for ( tmp = to; tmp != &init_user_ns;
-              tmp = tmp->creator->user_ns ) {
+        for ( tmp = to; tmp != &init_user_ns; tmp = tmp->parent ) {
                 if (cred->user == tmp->creator) {
                         return (uid_t)0;
                 }
@@ -120,8 +120,7 @@ gid_t user_ns_map_gid(struct user_namespace *to, const struct cred *cred, gid_t
         /* Is cred->user the creator of the target user_ns
          * or the creator of one of it's parents?
          */
-        for ( tmp = to; tmp != &init_user_ns;
-              tmp = tmp->creator->user_ns ) {
+        for ( tmp = to; tmp != &init_user_ns; tmp = tmp->parent ) {
                 if (cred->user == tmp->creator) {
                         return (gid_t)0;
                 }
diff --git a/security/commoncap.c b/security/commoncap.c
index 8b3e10e2eac7..435d074853f3 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -92,7 +92,7 @@ int cap_capable(const struct cred *cred, struct user_namespace *targ_ns,
                  *If you have a capability in a parent user ns, then you have
                  * it over all children user namespaces as well.
                  */
-                targ_ns = targ_ns->creator->user_ns;
+                targ_ns = targ_ns->parent;
         }
 
         /* We never get here */