diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2026-10-19 15:57:25 -1000 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2026-10-19 15:57:25 -1000 |
| commit | def41b7bd4f1c9fc8eedba70ceb05d999ea7bb1a (patch) | |
| tree | 6831cf4623d6f8100e4284963478276348e06479 /ipc | |
| parent | c03c1a14507dfaf8b856c2608f9ac216021fc222 (diff) | |
| parent | eb85469f0dd69ca145d63117450e14c31f67f698 (diff) | |
Merge tag 'ipc-7.4-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull ipc fix from Christian Brauner:
"This fixes a leak in mqueue.
A task in another thread group sharing the file table could register
an mq_notify() and exit without closing the queue. The registration
was never torn down and pinned the notification skb, the netlink
socket, a pid reference and a user namespace reference forever.
Stale registrations are released on inode eviction now"
* tag 'ipc-7.4-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
ipc/mqueue: release notification resources during inode eviction
Diffstat (limited to 'ipc')
| -rw-r--r-- | ipc/mqueue.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/ipc/mqueue.c b/ipc/mqueue.c index d1dd36a651b0..d1a1965c9811 100644 --- a/ipc/mqueue.c +++ b/ipc/mqueue.c @@ -528,6 +528,13 @@ static void mqueue_evict_inode(struct inode *inode) list_add_tail(&msg->m_list, &tmp_msg); kfree(info->node_cache); spin_unlock(&info->lock); + /* + * A shared file table can let the notification owner exit without + * running ->flush(). No users of the inode remain during eviction, so + * tear down any stale notification after dropping info->lock because + * netlink_sendskb() may release the final socket reference. + */ + remove_notification(info); list_for_each_entry_safe(msg, nmsg, &tmp_msg, m_list) { list_del(&msg->m_list); |