diff options
| author | Andrew Morton <akpm@linux-foundation.org> | 2022-10-20 21:19:22 -0700 |
|---|---|---|
| committer | Andrew Morton <akpm@linux-foundation.org> | 2022-10-28 13:37:22 -0700 |
| commit | 64b4c411a6c7a5f27555bfc2d6310b87bde3db67 (patch) | |
| tree | 878e60cfde45dea3ee6379d66b5a55c934947e24 /ipc | |
| parent | 27d676a1c2010450d00d514a8a6c1c780cb8d77f (diff) | |
| download | lwn-64b4c411a6c7a5f27555bfc2d6310b87bde3db67.tar.gz lwn-64b4c411a6c7a5f27555bfc2d6310b87bde3db67.zip | |
ipc/msg.c: fix percpu_counter use after free
These percpu counters are referenced in free_ipcs->freeque, so destroy
them later.
Fixes: 72d1e611082e ("ipc/msg: mitigate the lock contention with percpu counter")
Reported-by: syzbot+96e659d35b9d6b541152@syzkaller.appspotmail.com
Tested-by: Mark Rutland <mark.rutland@arm.com>
Cc: Jiebin Sun <jiebin.sun@intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Diffstat (limited to 'ipc')
| -rw-r--r-- | ipc/msg.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/ipc/msg.c b/ipc/msg.c index e4e0990e08f7..fd08b3cb36d7 100644 --- a/ipc/msg.c +++ b/ipc/msg.c @@ -1329,11 +1329,11 @@ fail_msg_bytes: #ifdef CONFIG_IPC_NS void msg_exit_ns(struct ipc_namespace *ns) { - percpu_counter_destroy(&ns->percpu_msg_bytes); - percpu_counter_destroy(&ns->percpu_msg_hdrs); free_ipcs(ns, &msg_ids(ns), freeque); idr_destroy(&ns->ids[IPC_MSG_IDS].ipcs_idr); rhashtable_destroy(&ns->ids[IPC_MSG_IDS].key_ht); + percpu_counter_destroy(&ns->percpu_msg_bytes); + percpu_counter_destroy(&ns->percpu_msg_hdrs); } #endif |