Broken "User namespaces: Only put the userns when we unhash the uid"

[Alexey Dobriyan <adobriyan@gmail.com>]

The following commit breaks clone(CLONE_NEWUSER)
with an oops.

	__lock_acquire
	lock_acquire
	_spin_lock
	_atomic_dec_and_lock
	free_uid
	free_user_ns
	kref_put
	free_uid
	put_cred_rcu
	rcu_process_callbacks

commit fb5ae64fdde29236e1a15e0366946df7060f41f2
Author: Serge E. Hallyn <serue@us.ibm.com>
Date:   Fri Feb 13 14:04:21 2009 +0000

    User namespaces: Only put the userns when we unhash the uid
    
    uids in namespaces other than init don't get a sysfs entry.
    
    For those in the init namespace, while we're waiting to remove
    the sysfs entry for the uid the uid is still hashed, and
    alloc_uid() may re-grab that uid without getting a new
    reference to the user_ns, which we've already put in free_user
    before scheduling remove_user_sysfs_dir().
    
    Reported-and-tested-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
    Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
    Acked-by: David Howells <dhowells@redhat.com>
    Tested-by: Ingo Molnar <mingo@elte.hu>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/kernel/user.c b/kernel/user.c
index 477b666..3551ac7 100644
--- a/kernel/user.c
+++ b/kernel/user.c
@@ -72,6 +72,7 @@ static void uid_hash_insert(struct user_struct *up, struct hlist_head *hashent)
 static void uid_hash_remove(struct user_struct *up)
 {
 	hlist_del_init(&up->uidhash_node);
+	put_user_ns(up->user_ns);
 }
 
 static struct user_struct *uid_hash_find(uid_t uid, struct hlist_head *hashent)
@@ -334,7 +335,6 @@ static void free_user(struct user_struct *up, unsigned long flags)
 	atomic_inc(&up->__count);
 	spin_unlock_irqrestore(&uidhash_lock, flags);
 
-	put_user_ns(up->user_ns);
 	INIT_WORK(&up->work, remove_user_sysfs_dir);
 	schedule_work(&up->work);
 }
@@ -357,7 +357,6 @@ static void free_user(struct user_struct *up, unsigned long flags)
 	sched_destroy_user(up);
 	key_put(up->uid_keyring);
 	key_put(up->session_keyring);
-	put_user_ns(up->user_ns);
 	kmem_cache_free(uid_cachep, up);
 }