Linux kernel Namespace源码分析

struct task_struct {
      ...
      /* namespaces */
      struct nsproxy *nsproxy;
      ...
}

/*
 * A structure to contain pointers to all per-process
 * namespaces - fs (mount), uts, network, sysvipc, etc.
 *
 * The pid namespace is an exception -- it's accessed using
 * task_active_pid_ns.  The pid namespace here is the
 * namespace that children will use.
 *
 * 'count' is the number of tasks holding a reference.
 * The count for each namespace, then, will be the number
 * of nsproxies pointing to it, not the number of tasks.
 *
 * The nsproxy is shared by tasks which share all namespaces.
 * As soon as a single namespace is cloned or unshared, the
 * nsproxy is copied.
 */
struct nsproxy {
      atomic_t count;
      struct uts_namespace *uts_ns;
      struct ipc_namespace *ipc_ns;
      struct mnt_namespace *mnt_ns;
      struct pid_namespace *pid_ns_for_children;
      struct net         *net_ns;
};

 int copy_namespaces(unsigned long flags, struct task_struct *tsk);
void exit_task_namespaces(struct task_struct *tsk);
void switch_task_namespaces(struct task_struct *tsk, struct nsproxy *new);
void free_nsproxy(struct nsproxy *ns);
int unshare_nsproxy_namespaces(unsigned long, struct nsproxy **, struct cred *, struct fs_struct *);
int __init nsproxy_cache_init(void);
static inline void put_nsproxy(struct nsproxy *ns) { … }
static inline void get_nsproxy(struct nsproxy *ns) { … }

struct uts_namespace {
       struct kref kref;
       struct new_utsname name;
       struct user_namespace *user_ns;
       struct ns_common ns;
};

struct ipc_namespace {
       atomic_t      count;
       struct ipc_ids      ids[3];
 
 
       int          sem_ctls[4];
       int          used_sems;
 
 
       unsigned int msg_ctlmax;
       unsigned int msg_ctlmnb;
       unsigned int msg_ctlmni;
       atomic_t      msg_bytes;
       atomic_t      msg_hdrs;
 
 
       size_t           shm_ctlmax;
       size_t           shm_ctlall;
       unsigned long     shm_tot;
       int          shm_ctlmni;
       /*
        * Defines whether IPC_RMID is forced for _all_ shm segments regardless
        * of shmctl()
        */
       int          shm_rmid_forced;
 
 
       struct notifier_block ipcns_nb;
 
 
       /* The kern_mount of the mqueuefs sb.  We take a ref on it */
       struct vfsmount  *mq_mnt;
 
 
       /* # queues in this ns, protected by mq_lock */
       unsigned int    mq_queues_count;
 
 
       /* next fields are set through sysctl */
       unsigned int    mq_queues_max;   /* initialized to DFLT_QUEUESMAX */
       unsigned int    mq_msg_max;      /* initialized to DFLT_MSGMAX */
       unsigned int    mq_msgsize_max;  /* initialized to DFLT_MSGSIZEMAX */
       unsigned int    mq_msg_default;
       unsigned int    mq_msgsize_default;
 
 
       /* user_ns which owns the ipc ns */
       struct user_namespace *user_ns;
 
 
       struct ns_common ns;
};

struct mnt_namespace {
       atomic_t             count;
       struct ns_common     ns;
       struct mount *    root;
       struct list_head   list;
       struct user_namespace    *user_ns;
       u64               seq; /* Sequence number to prevent loops */
       wait_queue_head_t poll;
       u64 event;
};

struct pid_namespace {
       struct kref kref;
       struct pidmap pidmap[PIDMAP_ENTRIES];
       struct rcu_head rcu;
       int last_pid;
       unsigned int nr_hashed;
       struct task_struct *child_reaper;
       struct kmem_cache *pid_cachep;
       unsigned int level;
       struct pid_namespace *parent;
#ifdef CONFIG_PROC_FS
       struct vfsmount *proc_mnt;
       struct dentry *proc_self;
       struct dentry *proc_thread_self;
#endif
#ifdef CONFIG_BSD_PROCESS_ACCT
       struct fs_pin *bacct;
#endif
       struct user_namespace *user_ns;
       struct work_struct proc_work;
       kgid_t pid_gid;
       int hide_pid;
       int reboot;    /* group exit code if this pidns was rebooted */
       struct ns_common ns;
};

struct net {
       atomic_t             passive; /* To decided when the network
                                           * namespace should be freed.
                                           */
       atomic_t             count;           /* To decided when the network
                                           *  namespace should be shut down.
                                           */
       spinlock_t            rules_mod_lock;
 
 
       atomic64_t         cookie_gen;
 
 
       struct list_head   list;        /* list of network namespaces */
       struct list_head   cleanup_list; /* namespaces on death row */
       struct list_head   exit_list;       /* Use only net_mutex */
 
 
       struct user_namespace   *user_ns;   /* Owning user namespace */
       spinlock_t            nsid_lock;
       struct idr             netns_ids;
 
 
       struct ns_common     ns;
 
 
       struct proc_dir_entry       *proc_net;
       struct proc_dir_entry       *proc_net_stat;
 
 
#ifdef CONFIG_SYSCTL
       struct ctl_table_set   sysctls;
#endif
 
 
       struct sock          *rtnl;                   /* rtnetlink socket */
       struct sock           *genl_sock;
 
 
       struct list_head dev_base_head;
       struct hlist_head       *dev_name_head;
       struct hlist_head *dev_index_head;
       unsigned int        dev_base_seq;    /* protected by rtnl_mutex */
       int                 ifindex;
       unsigned int        dev_unreg_count;
 
 
       /* core fib_rules */
       struct list_head   rules_ops;
 
       struct net_device       *loopback_dev;          /* The loopback */
       struct netns_core       core;
       struct netns_mib mib;
       struct netns_packet   packet;
       struct netns_unix       unx;
       struct netns_ipv4       ipv4;
#if IS_ENABLED(CONFIG_IPV6)
       struct netns_ipv6       ipv6;
#endif
#if IS_ENABLED(CONFIG_IEEE802154_6LOWPAN)
       struct netns_ieee802154_lowpan  ieee802154_lowpan;
#endif
#if defined(CONFIG_IP_SCTP) || defined(CONFIG_IP_SCTP_MODULE)
       struct netns_sctp       sctp;
#endif
#if defined(CONFIG_IP_DCCP) || defined(CONFIG_IP_DCCP_MODULE)
       struct netns_dccp      dccp;
#endif
#ifdef CONFIG_NETFILTER
       struct netns_nf          nf;
       struct netns_xt           xt;
#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
       struct netns_ct           ct;
#endif
#if defined(CONFIG_NF_TABLES) || defined(CONFIG_NF_TABLES_MODULE)
       struct netns_nftables nft;
#endif
#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
       struct netns_nf_frag  nf_frag;
#endif
       struct sock           *nfnl;
       struct sock           *nfnl_stash;
#if IS_ENABLED(CONFIG_NETFILTER_NETLINK_ACCT)
       struct list_head        nfnl_acct_list;
#endif
#endif
#ifdef CONFIG_WEXT_CORE
       struct sk_buff_head   wext_nlevents;
#endif
       struct net_generic __rcu  *gen;
 
 
       /* Note : following structs are cache line aligned */
#ifdef CONFIG_XFRM
       struct netns_xfrm      xfrm;
#endif
#if IS_ENABLED(CONFIG_IP_VS)
       struct netns_ipvs *ipvs;
#endif
#if IS_ENABLED(CONFIG_MPLS)
       struct netns_mpls      mpls;
#endif
       struct sock           *diag_nlsk;
       atomic_t             fnhe_genid;
};

#define INIT_TASK(tsk)   
{
…
nsproxy  = &init_nsproxy,
…
}
继续跟进init_nsproxy的定义，@ linux-4.4.19/kernel/nsproxy.c #31
struct nsproxy init_nsproxy = {
       .count                  = ATOMIC_INIT(1),
       .uts_ns                = &init_uts_ns,
#if defined(CONFIG_POSIX_MQUEUE) || defined(CONFIG_SYSVIPC)
       .ipc_ns                 = &init_ipc_ns,
#endif
       .mnt_ns               = NULL,
       .pid_ns_for_children  = &init_pid_ns,
#ifdef CONFIG_NET
       .net_ns                = &init_net,
#endif
};

#ifdef __ARCH_WANT_SYS_FORK
SYSCALL_DEFINE0(fork)
{
#ifdef CONFIG_MMU
       return _do_fork(SIGCHLD, 0, 0, NULL, NULL, 0);
#else
       /* can not support in nommu mode */
       return -EINVAL;
#endif
}
#endif
 
 
#ifdef __ARCH_WANT_SYS_VFORK
SYSCALL_DEFINE0(vfork)
{
       return _do_fork(CLONE_VFORK | CLONE_VM | SIGCHLD, 0,
                     0, NULL, NULL, 0);
}
#endif
  
 
 
#ifdef __ARCH_WANT_SYS_CLONE
#ifdef CONFIG_CLONE_BACKWARDS
SYSCALL_DEFINE5(clone, unsigned long, clone_flags, unsigned long, newsp,
               int __user *, parent_tidptr,
               unsigned long, tls,
               int __user *, child_tidptr)
#elif defined(CONFIG_CLONE_BACKWARDS2)
SYSCALL_DEFINE5(clone, unsigned long, newsp, unsigned long, clone_flags,
               int __user *, parent_tidptr,
               int __user *, child_tidptr,
               unsigned long, tls)
#elif defined(CONFIG_CLONE_BACKWARDS3)
SYSCALL_DEFINE6(clone, unsigned long, clone_flags, unsigned long, newsp,
              int, stack_size,
              int __user *, parent_tidptr,
              int __user *, child_tidptr,
              unsigned long, tls)
#else
SYSCALL_DEFINE5(clone, unsigned long, clone_flags, unsigned long, newsp,
               int __user *, parent_tidptr,
               int __user *, child_tidptr,
               unsigned long, tls)
#endif
{
       return _do_fork(clone_flags, newsp, 0, parent_tidptr, child_tidptr, tls);
}

long _do_fork(unsigned long clone_flags,
             unsigned long stack_start,
             unsigned long stack_size,
             int __user *parent_tidptr,
             int __user *child_tidptr,
             unsigned long tls)
{
 
 
       //创建进程描述符指针
       struct task_struct *p;
       int trace = 0;
       long nr;
 
 
       if (!(clone_flags & CLONE_UNTRACED)) {
              if (clone_flags & CLONE_VFORK)
                     trace = PTRACE_EVENT_VFORK;
              else if ((clone_flags & CSIGNAL) != SIGCHLD)
                     trace = PTRACE_EVENT_CLONE;
              else
                     trace = PTRACE_EVENT_FORK;
 
 
              if (likely(!ptrace_event_enabled(current, trace)))
                     trace = 0;
       }
  
       //复制进程描述符，copy_process()的返回值是一个 task_struct 指针。
       p = copy_process(clone_flags, stack_start, stack_size,
                      child_tidptr, NULL, trace, tls);
       
       if (!IS_ERR(p)) {
              struct completion vfork;
              struct pid *pid;
 
 
              trace_sched_process_fork(current, p);
  
              //得到新创建的进程描述符中的pid
              pid = get_task_pid(p, PIDTYPE_PID);
              nr = pid_vnr(pid);
 
 
              if (clone_flags & CLONE_PARENT_SETTID)
                     put_user(nr, parent_tidptr);
 
 
              //如果调用的 vfork()方法，初始化 vfork 完成处理信息。
              if (clone_flags & CLONE_VFORK) {
                     p->vfork_done = &vfork;
                     init_completion(&vfork);
                     get_task_struct(p);
              }
 
 
              //将子进程加入到调度器中，为其分配 CPU，准备执行
              wake_up_new_task(p);
 
 
              //fork 完成，子进程即将开始运行
              if (unlikely(trace))
                     ptrace_event_pid(trace, pid);
 
 
               //如果是 vfork，将父进程加入至等待队列，等待子进程完成
              if (clone_flags & CLONE_VFORK) {
                     if (!wait_for_vfork_done(p, &vfork))
                            ptrace_event_pid(PTRACE_EVENT_VFORK_DONE, pid);
              }
 
 
              put_pid(pid);
       } else {
              nr = PTR_ERR(p);
       }
       return nr;
}

static struct task_struct *copy_process(unsigned long clone_flags,
                                   unsigned long stack_start,
                                   unsigned long stack_size,
                                   int __user *child_tidptr,
                                   struct pid *pid,
                                   int trace,
                                   unsigned long tls)
{
       int retval;
 
        //创建进程描述符指针
       struct task_struct *p;
       void *cgrp_ss_priv[CGROUP_CANFORK_COUNT] = {};
 
 
        // 检查clone flags的合法性，比如CLONE_NEWNS与CLONE_FS是互斥的；
       if ((clone_flags & (CLONE_NEWNS|CLONE_FS)) == (CLONE_NEWNS|CLONE_FS))
              return ERR_PTR(-EINVAL);
       if ((clone_flags & (CLONE_NEWUSER|CLONE_FS)) == (CLONE_NEWUSER|CLONE_FS))
              return ERR_PTR(-EINVAL);
       if ((clone_flags & CLONE_THREAD) && !(clone_flags & CLONE_SIGHAND))
              return ERR_PTR(-EINVAL);
       if ((clone_flags & CLONE_SIGHAND) && !(clone_flags & CLONE_VM))
              return ERR_PTR(-EINVAL);
 
       // 比如CLONE_PARENT时得检查当前signal flags是否为SIGNAL_UNKILLABLE，防止kill init进程。
       if ((clone_flags & CLONE_PARENT) &&
                            current->signal->flags & SIGNAL_UNKILLABLE)
              return ERR_PTR(-EINVAL);
       if (clone_flags & CLONE_THREAD) {
              if ((clone_flags & (CLONE_NEWUSER | CLONE_NEWPID)) ||
                  (task_active_pid_ns(current) !=
                            current->nsproxy->pid_ns_for_children))
                     return ERR_PTR(-EINVAL);
       }
       retval = security_task_create(clone_flags);
       if (retval)
              goto fork_out;
       retval = -ENOMEM;
 
 
       // 复制当前的task_struct
       p = dup_task_struct(current);
       if (!p)
              goto fork_out;
 
       ftrace_graph_init_task(p);
       
       // 初始化互斥变量
       rt_mutex_init_task(p);
 
 
#ifdef CONFIG_PROVE_LOCKING
       DEBUG_LOCKS_WARN_ON(!p->hardirqs_enabled);
       DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
#endif
       retval = -EAGAIN;
 
 
       // 检查进程数是否是超过限制，由OS定义
       if (atomic_read(&p->real_cred->user->processes) >=
                     task_rlimit(p, RLIMIT_NPROC)) {
              if (p->real_cred->user != INIT_USER &&
                  !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN))
                     goto bad_fork_free;
       }
       current->flags &= ~PF_NPROC_EXCEEDED;
       retval = copy_creds(p, clone_flags);
       if (retval < 0)
              goto bad_fork_free;
       retval = -EAGAIN;
  
        //检查进程数是否超过 max_threads 由内存大小决定
       if (nr_threads >= max_threads)
              goto bad_fork_cleanup_count;
 
       delayacct_tsk_init(p);       /* Must remain after dup_task_struct() */
       p->flags &= ~(PF_SUPERPRIV | PF_WQ_WORKER);
       p->flags |= PF_FORKNOEXEC;
       INIT_LIST_HEAD(&p->children);
       INIT_LIST_HEAD(&p->sibling);
       rcu_copy_process(p);
       p->vfork_done = NULL;
 
 
       //初始化自旋锁
       spin_lock_init(&p->alloc_lock);
       //初始化挂起信号
       init_sigpending(&p->pending);
 
 
       p->utime = p->stime = p->gtime = 0;
       p->utimescaled = p->stimescaled = 0;
       prev_cputime_init(&p->prev_cputime);
 
 
#ifdef CONFIG_VIRT_CPU_ACCOUNTING_GEN
       seqlock_init(&p->vtime_seqlock);
       p->vtime_snap = 0;
       p->vtime_snap_whence = VTIME_SLEEPING;
#endif
#if defined(SPLIT_RSS_COUNTING)
       memset(&p->rss_stat, 0, sizeof(p->rss_stat));
#endif
       p->default_timer_slack_ns = current->timer_slack_ns;
       task_io_accounting_init(&p->ioac);
       acct_clear_integrals(p);
 
       // 初始化CPU定时器
       posix_cpu_timers_init(p);
 
       p->start_time = ktime_get_ns();
       p->real_start_time = ktime_get_boot_ns();
       p->io_context = NULL;
       p->audit_context = NULL;
       threadgroup_change_begin(current);
       cgroup_fork(p);
        //......
 
        //初始化进程数据结构，并把进程状态设置为 TASK_RUNNING
       retval = sched_fork(clone_flags, p);
 
 
        //复制所有进程信息，包括文件系统、信号处理函数、信号、内存管理等
       if (retval)
              goto bad_fork_cleanup_policy;
 
       retval = perf_event_init_task(p);
       if (retval)
              goto bad_fork_cleanup_policy;
       retval = audit_alloc(p);
       if (retval)
              goto bad_fork_cleanup_perf;
       /* copy all the process information */
       shm_init_task(p);
       retval = copy_semundo(clone_flags, p);
       if (retval)
              goto bad_fork_cleanup_audit;
       retval = copy_files(clone_flags, p);
       if (retval)
              goto bad_fork_cleanup_semundo;
       retval = copy_fs(clone_flags, p);
       if (retval)
              goto bad_fork_cleanup_files;
       retval = copy_sighand(clone_flags, p);
       if (retval)
              goto bad_fork_cleanup_fs;
       retval = copy_signal(clone_flags, p);
       if (retval)
              goto bad_fork_cleanup_sighand;
       retval = copy_mm(clone_flags, p);
       if (retval)
              goto bad_fork_cleanup_signal;
 
       // 复制namespaces
       retval = copy_namespaces(clone_flags, p);
       if (retval)
              goto bad_fork_cleanup_mm;
       retval = copy_io(clone_flags, p);
       if (retval)
              goto bad_fork_cleanup_namespaces;
 
       // 初始化子进程内核栈
       retval = copy_thread_tls(clone_flags, stack_start, stack_size, p, tls);
       if (retval)
              goto bad_fork_cleanup_io;
 
        //为新进程分配新的 pid
       if (pid != &init_struct_pid) {
              pid = alloc_pid(p->nsproxy->pid_ns_for_children);
              if (IS_ERR(pid)) {
                     retval = PTR_ERR(pid);
                     goto bad_fork_cleanup_io;
              }
       }
 
       p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
       p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? child_tidptr : NULL;
 
        //......
        //设置子进程 pid       
       p->pid = pid_nr(pid);
        //......
 
       /*
        * Ensure that the cgroup subsystem policies allow the new process to be
        * forked. It should be noted the the new process's css_set can be changed
        * between here and cgroup_post_fork() if an organisation operation is in
        * progress.
        */
       retval = cgroup_can_fork(p, cgrp_ss_priv);
       if (retval)
              goto bad_fork_free_pid;
 
 
       /*
        * Make it visible to the rest of the system, but dont wake it up yet.
        * Need tasklist lock for parent etc handling!
        */
       write_lock_irq(&tasklist_lock);
 
 
       /* CLONE_PARENT re-uses the old parent */
       if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) {
              p->real_parent = current->real_parent;
              p->parent_exec_id = current->parent_exec_id;
       } else {
              p->real_parent = current;
              p->parent_exec_id = current->self_exec_id;
       }
 
 
       spin_lock(&current->sighand->siglock);
 
 
       // 复制seccommp配置
       copy_seccomp(p);
 
 
       /*
        * Process group and session signals need to be delivered to just the
        * parent before the fork or both the parent and the child after the
        * fork. Restart if a signal comes in before we add the new process to
        * it's process group.
        * A fatal signal pending means that current will exit, so the new
        * thread can't slip out of an OOM kill (or normal SIGKILL).
       */
       recalc_sigpending();
       if (signal_pending(current)) {
              spin_unlock(&current->sighand->siglock);
              write_unlock_irq(&tasklist_lock);
              retval = -ERESTARTNOINTR;
              goto bad_fork_cancel_cgroup;
       }
 
        //......
 
       total_forks++;
       spin_unlock(&current->sighand->siglock);
       syscall_tracepoint_update(p);
       write_unlock_irq(&tasklist_lock);
 
       proc_fork_connector(p);
       cgroup_post_fork(p, cgrp_ss_priv);
       threadgroup_change_end(current);
       perf_event_fork(p);
 
       trace_task_newtask(p, clone_flags);
       uprobe_copy_process(p, clone_flags);
 
       // 返回结构体p
       return p;
}

static struct task_struct *dup_task_struct(struct task_struct *orig)
{
       struct task_struct *tsk;
       struct thread_info *ti;
       int node = tsk_fork_get_node(orig);
       int err;
 
       //分配一个 task_struct 节点
       tsk = alloc_task_struct_node(node);
       if (!tsk)
              return NULL;
 
       //分配一个 thread_info 节点，包含进程的内核栈，ti 为栈底
       ti = alloc_thread_info_node(tsk, node);
       if (!ti)
              goto free_tsk;
 
       //将栈底的值赋给新节点的栈
       tsk->stack = ti;
 
       //……
 
       return tsk;
}

union thread_union {
   struct thread_info thread_info;
  unsigned long stack[THREAD_SIZE/sizeof(long)];
};

int sched_fork(unsigned long clone_flags, struct task_struct *p)
{
       unsigned long flags;
       int cpu = get_cpu();
 
 
       __sched_fork(clone_flags, p);
         
       //将子进程状态设置为 TASK_RUNNING
       p->state = TASK_RUNNING;
       
       //……
       
       //为子进程分配 CPU
       set_task_cpu(p, cpu);
 
 
       put_cpu();
       return 0;
}

int copy_thread_tls(unsigned long clone_flags, unsigned long sp,
              unsigned long arg, struct task_struct *p, unsigned long tls)
{
       int err;
       struct pt_regs *childregs;
       struct task_struct *me = current;
 
 
       p->thread.sp0 = (unsigned long)task_stack_page(p) + THREAD_SIZE;
 
 
       // 获取寄存器信息
       childregs = task_pt_regs(p);
       p->thread.sp = (unsigned long) childregs;
       set_tsk_thread_flag(p, TIF_FORK);
       p->thread.io_bitmap_ptr = NULL;
 
 
       savesegment(gs, p->thread.gsindex);
       p->thread.gs = p->thread.gsindex ? 0 : me->thread.gs;
       savesegment(fs, p->thread.fsindex);
       p->thread.fs = p->thread.fsindex ? 0 : me->thread.fs;
       savesegment(es, p->thread.es);
       savesegment(ds, p->thread.ds);
       memset(p->thread.ptrace_bps, 0, sizeof(p->thread.ptrace_bps));
 
 
       if (unlikely(p->flags & PF_KTHREAD)) {
              /* kernel thread */
              memset(childregs, 0, sizeof(struct pt_regs));
              childregs->sp = (unsigned long)childregs;
              childregs->ss = __KERNEL_DS;
              childregs->bx = sp; /* function */
              childregs->bp = arg;
              childregs->orig_ax = -1;
              childregs->cs = __KERNEL_CS | get_kernel_rpl();
              childregs->flags = X86_EFLAGS_IF | X86_EFLAGS_FIXED;
              return 0;
       }
 
 
       // 将当前寄存器信息复制给子进程
       *childregs = *current_pt_regs();
 
 
       //子进程 eax 置 0，因此fork 在子进程返回0
       childregs->ax = 0;
       if (sp)
              childregs->sp = sp;
 
 
       err = -ENOMEM;
       if (unlikely(test_tsk_thread_flag(me, TIF_IO_BITMAP))) {
              p->thread.io_bitmap_ptr = kmemdup(me->thread.io_bitmap_ptr,
                                            IO_BITMAP_BYTES, GFP_KERNEL);
              if (!p->thread.io_bitmap_ptr) {
                     p->thread.io_bitmap_max = 0;
                     return -ENOMEM;
              }
              set_tsk_thread_flag(p, TIF_IO_BITMAP);
       }
 
 
       /*
        * Set a new TLS for the child thread?
        */
       if (clone_flags & CLONE_SETTLS) {
#ifdef CONFIG_IA32_EMULATION
              if (is_ia32_task())
                     err = do_set_thread_area(p, -1,
                            (struct user_desc __user *)tls, 0);
              else
#endif
                     err = do_arch_prctl(p, ARCH_SET_FS, tls);
              if (err)
                     goto out;
       }
       err = 0;
out:
       if (err && p->thread.io_bitmap_ptr) {
              kfree(p->thread.io_bitmap_ptr);
              p->thread.io_bitmap_max = 0;
       }
 
 
       return err;
}

int copy_namespaces(unsigned long flags, struct task_struct *tsk)
{
       struct nsproxy *old_ns = tsk->nsproxy;
       struct user_namespace *user_ns = task_cred_xxx(tsk, user_ns);
       struct nsproxy *new_ns;
 
 
       if (likely(!(flags & (CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWIPC |
                           CLONE_NEWPID | CLONE_NEWNET)))) {
              get_nsproxy(old_ns);
              return 0;
       }
 
 
       if (!ns_capable(user_ns, CAP_SYS_ADMIN))
              return -EPERM;
 
 
       /*
        * CLONE_NEWIPC must detach from the undolist: after switching
        * to a new ipc namespace, the semaphore arrays from the old
        * namespace are unreachable.  In clone parlance, CLONE_SYSVSEM
        * means share undolist with parent, so we must forbid using
        * it along with CLONE_NEWIPC.
        */
       if ((flags & (CLONE_NEWIPC | CLONE_SYSVSEM)) ==
              (CLONE_NEWIPC | CLONE_SYSVSEM))
              return -EINVAL;
 
 
       new_ns = create_new_namespaces(flags, tsk, user_ns, tsk->fs);
       if (IS_ERR(new_ns))
              return  PTR_ERR(new_ns);
 
 
       tsk->nsproxy = new_ns;
       return 0;
}

/*
 * Create new nsproxy and all of its the associated namespaces.
 * Return the newly created nsproxy.  Do not attach this to the task,
 * leave it to the caller to do proper locking and attach it to task.
 */
static struct nsproxy *create_new_namespaces(unsigned long flags,
       struct task_struct *tsk, struct user_namespace *user_ns,
       struct fs_struct *new_fs)
{
       struct nsproxy *new_nsp;
       int err;
 
 
       new_nsp = create_nsproxy();
       if (!new_nsp)
              return ERR_PTR(-ENOMEM);
 
 
       new_nsp->mnt_ns = copy_mnt_ns(flags, tsk->nsproxy->mnt_ns, user_ns, new_fs);
       if (IS_ERR(new_nsp->mnt_ns)) {
              err = PTR_ERR(new_nsp->mnt_ns);
              goto out_ns;
       }
 
 
       new_nsp->uts_ns = copy_utsname(flags, user_ns, tsk->nsproxy->uts_ns);
       if (IS_ERR(new_nsp->uts_ns)) {
              err = PTR_ERR(new_nsp->uts_ns);
              goto out_uts;
       }
 
 
       new_nsp->ipc_ns = copy_ipcs(flags, user_ns, tsk->nsproxy->ipc_ns);
       if (IS_ERR(new_nsp->ipc_ns)) {
              err = PTR_ERR(new_nsp->ipc_ns);
              goto out_ipc;
       }
 
 
       new_nsp->pid_ns_for_children =
              copy_pid_ns(flags, user_ns, tsk->nsproxy->pid_ns_for_children);
       if (IS_ERR(new_nsp->pid_ns_for_children)) {
              err = PTR_ERR(new_nsp->pid_ns_for_children);
              goto out_pid;
       }
 
 
       new_nsp->net_ns = copy_net_ns(flags, user_ns, tsk->nsproxy->net_ns);
       if (IS_ERR(new_nsp->net_ns)) {
              err = PTR_ERR(new_nsp->net_ns);
              goto out_net;
       }
 
 
       return new_nsp;
 
 
out_net:
       if (new_nsp->pid_ns_for_children)
              put_pid_ns(new_nsp->pid_ns_for_children);
out_pid:
       if (new_nsp->ipc_ns)
              put_ipc_ns(new_nsp->ipc_ns);
out_ipc:
       if (new_nsp->uts_ns)
              put_uts_ns(new_nsp->uts_ns);
out_uts:
       if (new_nsp->mnt_ns)
              put_mnt_ns(new_nsp->mnt_ns);
out_ns:
       kmem_cache_free(nsproxy_cachep, new_nsp);
       return ERR_PTR(err);
}