1 files changed, 21 insertions, 20 deletions

diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
index fab8ea86fac3..86b3796b0436 100644
--- a/kernel/pid_namespace.c
+++ b/kernel/pid_namespace.c
@@ -67,9 +67,10 @@ err_alloc:
         return NULL;
 }
 
-static struct pid_namespace *create_pid_namespace(unsigned int level)
+static struct pid_namespace *create_pid_namespace(struct pid_namespace *parent_pid_ns)
 {
         struct pid_namespace *ns;
+        unsigned int level = parent_pid_ns->level + 1;
         int i;
 
         ns = kmem_cache_zalloc(pid_ns_cachep, GFP_KERNEL);
@@ -86,6 +87,7 @@ static struct pid_namespace *create_pid_namespace(unsigned int level)
 
         kref_init(&ns->kref);
         ns->level = level;
+        ns->parent = get_pid_ns(parent_pid_ns);
 
         set_bit(0, ns->pidmap[0].page);
         atomic_set(&ns->pidmap[0].nr_free, BITS_PER_PAGE - 1);
@@ -114,25 +116,11 @@ static void destroy_pid_namespace(struct pid_namespace *ns)
 
 struct pid_namespace *copy_pid_ns(unsigned long flags, struct pid_namespace *old_ns)
 {
-        struct pid_namespace *new_ns;
-
-        BUG_ON(!old_ns);
-        new_ns = get_pid_ns(old_ns);
         if (!(flags & CLONE_NEWPID))
-                goto out;
-
-        new_ns = ERR_PTR(-EINVAL);
-        if (flags & CLONE_THREAD)
-                goto out_put;
-
-        new_ns = create_pid_namespace(old_ns->level + 1);
-        if (!IS_ERR(new_ns))
-                new_ns->parent = get_pid_ns(old_ns);
-
-out_put:
-        put_pid_ns(old_ns);
-out:
-        return new_ns;
+                return get_pid_ns(old_ns);
+        if (flags & (CLONE_THREAD|CLONE_PARENT))
+                return ERR_PTR(-EINVAL);
+        return create_pid_namespace(old_ns);
 }
 
 void free_pid_ns(struct kref *kref)
@@ -152,6 +140,7 @@ void zap_pid_ns_processes(struct pid_namespace *pid_ns)
 {
         int nr;
         int rc;
+        struct task_struct *task;
 
         /*
          * The last thread in the cgroup-init thread group is terminating.
@@ -169,7 +158,19 @@ void zap_pid_ns_processes(struct pid_namespace *pid_ns)
         read_lock(&tasklist_lock);
         nr = next_pidmap(pid_ns, 1);
         while (nr > 0) {
-                kill_proc_info(SIGKILL, SEND_SIG_PRIV, nr);
+                rcu_read_lock();
+
+                /*
+                 * Use force_sig() since it clears SIGNAL_UNKILLABLE ensuring
+                 * any nested-container's init processes don't ignore the
+                 * signal
+                 */
+                task = pid_task(find_vpid(nr), PIDTYPE_PID);
+                if (task)
+                        force_sig(SIGKILL, task);
+
+                rcu_read_unlock();
+
                 nr = next_pidmap(pid_ns, nr);
         }
         read_unlock(&tasklist_lock);