3 files changed, 37 insertions, 14 deletions

diff --git a/kernel/user.c b/kernel/user.c
index e7d11cef6998..9ca2848fc356 100644
--- a/kernel/user.c
+++ b/kernel/user.c
@@ -55,25 +55,22 @@ struct user_struct root_user = {
 /*
  * These routines must be called with the uidhash spinlock held!
  */
-static inline void uid_hash_insert(struct user_struct *up, struct list_head *hashent)
+static inline void uid_hash_insert(struct user_struct *up, struct hlist_head *hashent)
 {
-        list_add(&up->uidhash_list, hashent);
+        hlist_add_head(&up->uidhash_node, hashent);
 }
 
 static inline void uid_hash_remove(struct user_struct *up)
 {
-        list_del(&up->uidhash_list);
+        hlist_del_init(&up->uidhash_node);
 }
 
-static inline struct user_struct *uid_hash_find(uid_t uid, struct list_head *hashent)
+static inline struct user_struct *uid_hash_find(uid_t uid, struct hlist_head *hashent)
 {
-        struct list_head *up;
-
-        list_for_each(up, hashent) {
-                struct user_struct *user;
-
-                user = list_entry(up, struct user_struct, uidhash_list);
+        struct user_struct *user;
+        struct hlist_node *h;
 
+        hlist_for_each_entry(user, h, hashent, uidhash_node) {
                 if(user->uid == uid) {
                         atomic_inc(&user->__count);
                         return user;
@@ -122,7 +119,7 @@ void free_uid(struct user_struct *up)
 
 struct user_struct * alloc_uid(struct user_namespace *ns, uid_t uid)
 {
-        struct list_head *hashent = uidhashentry(ns, uid);
+        struct hlist_head *hashent = uidhashentry(ns, uid);
         struct user_struct *up;
 
         spin_lock_irq(&uidhash_lock);
@@ -202,6 +199,30 @@ void switch_uid(struct user_struct *new_user)
         suid_keys(current);
 }
 
+void release_uids(struct user_namespace *ns)
+{
+        int i;
+        unsigned long flags;
+        struct hlist_head *head;
+        struct hlist_node *nd;
+
+        spin_lock_irqsave(&uidhash_lock, flags);
+        /*
+         * collapse the chains so that the user_struct-s will
+         * be still alive, but not in hashes. subsequent free_uid()
+         * will free them.
+         */
+        for (i = 0; i < UIDHASH_SZ; i++) {
+                head = ns->uidhash_table + i;
+                while (!hlist_empty(head)) {
+                        nd = head->first;
+                        hlist_del_init(nd);
+                }
+        }
+        spin_unlock_irqrestore(&uidhash_lock, flags);
+
+        free_uid(ns->root_user);
+}
 
 static int __init uid_cache_init(void)
 {
@@ -211,7 +232,7 @@ static int __init uid_cache_init(void)
                         0, SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
 
         for(n = 0; n < UIDHASH_SZ; ++n)
-                INIT_LIST_HEAD(init_user_ns.uidhash_table + n);
+                INIT_HLIST_HEAD(init_user_ns.uidhash_table + n);
 
         /* Insert the root user immediately (init already runs as root) */
         spin_lock_irq(&uidhash_lock);
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index 85af9422ea6e..7af90fc4f0fd 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -39,7 +39,7 @@ static struct user_namespace *clone_user_ns(struct user_namespace *old_ns)
         kref_init(&ns->kref);
 
         for (n = 0; n < UIDHASH_SZ; ++n)
-                INIT_LIST_HEAD(ns->uidhash_table + n);
+                INIT_HLIST_HEAD(ns->uidhash_table + n);
 
         /* Insert new root user.  */
         ns->root_user = alloc_uid(ns, 0);
@@ -81,7 +81,7 @@ void free_user_ns(struct kref *kref)
         struct user_namespace *ns;
 
         ns = container_of(kref, struct user_namespace, kref);
-        free_uid(ns->root_user);
+        release_uids(ns);
         kfree(ns);
 }
 
diff --git a/kernel/utsname.c b/kernel/utsname.c
index 9d8180a0f0d8..816d7b24fa03 100644
--- a/kernel/utsname.c
+++ b/kernel/utsname.c
@@ -28,7 +28,9 @@ static struct uts_namespace *clone_uts_ns(struct uts_namespace *old_ns)
         if (!ns)
                 return ERR_PTR(-ENOMEM);
 
+        down_read(&uts_sem);
         memcpy(&ns->name, &old_ns->name, sizeof(ns->name));
+        up_read(&uts_sem);
         kref_init(&ns->kref);
         return ns;
 }