3 files changed, 36 insertions, 22 deletions

diff --git a/kernel/exit.c b/kernel/exit.c
index d22aefabb129..db9764186d5a 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -400,9 +400,10 @@ void daemonize(const char *name, ...)
         current->fs = fs;
         atomic_inc(&fs->count);
 
-        exit_task_namespaces(current);
-        current->nsproxy = init_task.nsproxy;
-        get_task_namespaces(current);
+        if (current->nsproxy != init_task.nsproxy) {
+                get_nsproxy(init_task.nsproxy);
+                switch_task_namespaces(current, init_task.nsproxy);
+        }
 
         exit_files(current);
         current->files = init_task.files;
diff --git a/kernel/fork.c b/kernel/fork.c
index 2deaf481efab..d2f4a420a5b9 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1632,7 +1632,7 @@ asmlinkage long sys_unshare(unsigned long unshare_flags)
         struct mm_struct *mm, *new_mm = NULL, *active_mm = NULL;
         struct files_struct *fd, *new_fd = NULL;
         struct sem_undo_list *new_ulist = NULL;
-        struct nsproxy *new_nsproxy = NULL, *old_nsproxy = NULL;
+        struct nsproxy *new_nsproxy = NULL;
 
         check_unshare_flags(&unshare_flags);
 
@@ -1662,14 +1662,13 @@ asmlinkage long sys_unshare(unsigned long unshare_flags)
 
         if (new_fs ||  new_mm || new_fd || new_ulist || new_nsproxy) {
 
-                task_lock(current);
-
                 if (new_nsproxy) {
-                        old_nsproxy = current->nsproxy;
-                        current->nsproxy = new_nsproxy;
-                        new_nsproxy = old_nsproxy;
+                        switch_task_namespaces(current, new_nsproxy);
+                        new_nsproxy = NULL;
                 }
 
+                task_lock(current);
+
                 if (new_fs) {
                         fs = current->fs;
                         current->fs = new_fs;
diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c
index e981c61304f1..c8ef7c2992ed 100644
--- a/kernel/nsproxy.c
+++ b/kernel/nsproxy.c
@@ -26,19 +26,6 @@ static struct kmem_cache *nsproxy_cachep;
 
 struct nsproxy init_nsproxy = INIT_NSPROXY(init_nsproxy);
 
-static inline void get_nsproxy(struct nsproxy *ns)
-{
-        atomic_inc(&ns->count);
-}
-
-void get_task_namespaces(struct task_struct *tsk)
-{
-        struct nsproxy *ns = tsk->nsproxy;
-        if (ns) {
-                get_nsproxy(ns);
-        }
-}
-
 /*
  * creates a copy of "orig" with refcount 1.
  */
@@ -216,6 +203,33 @@ out:
         return err;
 }
 
+void switch_task_namespaces(struct task_struct *p, struct nsproxy *new)
+{
+        struct nsproxy *ns;
+
+        might_sleep();
+
+        ns = p->nsproxy;
+
+        rcu_assign_pointer(p->nsproxy, new);
+
+        if (ns && atomic_dec_and_test(&ns->count)) {
+                /*
+                 * wait for others to get what they want from this nsproxy.
+                 *
+                 * cannot release this nsproxy via the call_rcu() since
+                 * put_mnt_ns() will want to sleep
+                 */
+                synchronize_rcu();
+                free_nsproxy(ns);
+        }
+}
+
+void exit_task_namespaces(struct task_struct *p)
+{
+        switch_task_namespaces(p, NULL);
+}
+
 static int __init nsproxy_cache_init(void)
 {
         nsproxy_cachep = KMEM_CACHE(nsproxy, SLAB_PANIC);