diff options
| author | Daehyeon Ko <4ncienth@gmail.com> | 2026-08-24 13:23:59 +0900 |
|---|---|---|
| committer | Christian Brauner <brauner@kernel.org> | 2026-08-31 12:30:30 +0200 |
| commit | eb85469f0dd69ca145d63117450e14c31f67f698 (patch) | |
| tree | 9f505a3667fec887424002ca024b759b40781ab0 /tools/lib/python/kdoc/python_version.py | |
| parent | cee9395acd8043be0644b25c34bfa86623f2b935 (diff) | |
| download | linux-next-eb85469f0dd69ca145d63117450e14c31f67f698.tar.gz linux-next-eb85469f0dd69ca145d63117450e14c31f67f698.zip | |
ipc/mqueue: release notification resources during inode eviction
mqueue_flush_file() removes an mq_notify() registration only when the
closing task belongs to the thread group stored in notify_owner.
A task in a separate thread group created with CLONE_FILES can register
SIGEV_THREAD notification and exit without closing the shared file table.
If another thread group then unlinks and last-closes the queue, ->flush()
skips the registration and inode eviction loses the only pointers to its
resources.
The orphaned registration permanently retains the notification skb, its
netlink socket, a pid reference and a user namespace reference. An
unprivileged process can repeat the sequence with new queues and sockets.
No inode users remain during eviction. Remove any stale registration there
after dropping info->lock, since netlink_sendskb() may release the final
socket reference.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Link: https://patch.msgid.link/20260824042359.925145-1-4ncienth@gmail.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Diffstat (limited to 'tools/lib/python/kdoc/python_version.py')
0 files changed, 0 insertions, 0 deletions