3 files changed, 27 insertions, 2 deletions

diff --git a/include/linux/sched.h b/include/linux/sched.h
index 6239bc2c2baa..5445eaec6908 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1472,6 +1472,7 @@ static inline struct user_struct *get_uid(struct user_struct *u)
 }
 extern void free_uid(struct user_struct *);
 extern void switch_uid(struct user_struct *);
+extern void release_uids(struct user_namespace *ns);
 
 #include <asm/current.h>
 
diff --git a/kernel/user.c b/kernel/user.c
index add57c7e4c07..9ca2848fc356 100644
--- a/kernel/user.c
+++ b/kernel/user.c
@@ -62,7 +62,7 @@ static inline void uid_hash_insert(struct user_struct *up, struct hlist_head *ha
 
 static inline void uid_hash_remove(struct user_struct *up)
 {
-        hlist_del(&up->uidhash_node);
+        hlist_del_init(&up->uidhash_node);
 }
 
 static inline struct user_struct *uid_hash_find(uid_t uid, struct hlist_head *hashent)
@@ -199,6 +199,30 @@ void switch_uid(struct user_struct *new_user)
         suid_keys(current);
 }
 
+void release_uids(struct user_namespace *ns)
+{
+        int i;
+        unsigned long flags;
+        struct hlist_head *head;
+        struct hlist_node *nd;
+
+        spin_lock_irqsave(&uidhash_lock, flags);
+        /*
+         * collapse the chains so that the user_struct-s will
+         * be still alive, but not in hashes. subsequent free_uid()
+         * will free them.
+         */
+        for (i = 0; i < UIDHASH_SZ; i++) {
+                head = ns->uidhash_table + i;
+                while (!hlist_empty(head)) {
+                        nd = head->first;
+                        hlist_del_init(nd);
+                }
+        }
+        spin_unlock_irqrestore(&uidhash_lock, flags);
+
+        free_uid(ns->root_user);
+}
 
 static int __init uid_cache_init(void)
 {
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index e7ba1bf8457c..7af90fc4f0fd 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -81,7 +81,7 @@ void free_user_ns(struct kref *kref)
         struct user_namespace *ns;
 
         ns = container_of(kref, struct user_namespace, kref);
-        free_uid(ns->root_user);
+        release_uids(ns);
         kfree(ns);
 }