1 files changed, 11 insertions, 0 deletions

diff --git a/kernel/user.c b/kernel/user.c
index 6408c0424291..220e586127a0 100644
--- a/kernel/user.c
+++ b/kernel/user.c
@@ -187,6 +187,17 @@ void switch_uid(struct user_struct *new_user)
         atomic_dec(&old_user->processes);
         switch_uid_keyring(new_user);
         current->user = new_user;
+
+        /*
+         * We need to synchronize with __sigqueue_alloc()
+         * doing a get_uid(p->user).. If that saw the old
+         * user value, we need to wait until it has exited
+         * its critical region before we can free the old
+         * structure.
+         */
+        smp_mb();
+        spin_unlock_wait(&current->sighand->siglock);
+
         free_uid(old_user);
         suid_keys(current);
 }