Commit c7e12b83 authored by Pavel Emelianov's avatar Pavel Emelianov Committed by Linus Torvalds
Browse files

[PATCH] Fix ipc entries removal 



Fix two issuses related to ipc_ids->entries freeing.

1. When freeing ipc namespace we need to free entries allocated
   with ipc_init_ids().

2. When removing old entries in grow_ary() ipc_rcu_putref()
   may be called on entries set to &ids->nullentry earlier in
   ipc_init_ids().
   This is almost impossible without namespaces, but with
   them this situation becomes possible.

Found during OpenVZ testing after obvious leaks in beancounters.

Signed-off-by: default avatarPavel Emelianov <xemul@openvz.org>
Cc: Kirill Korotaev <dev@openvz.org>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent 733b72c3

ipc/msg.c

+1 −0
Original line number Diff line number Diff line
@@ -124,6 +124,7 @@ void msg_exit_ns(struct ipc_namespace *ns) 
	}

	mutex_unlock(&msg_ids(ns).mutex);



	ipc_fini_ids(ns->ids[IPC_MSG_IDS]);

	kfree(ns->ids[IPC_MSG_IDS]);

	ns->ids[IPC_MSG_IDS] = NULL;

}

ipc/sem.c

+1 −0
Original line number Diff line number Diff line
@@ -161,6 +161,7 @@ void sem_exit_ns(struct ipc_namespace *ns) 
	}

	mutex_unlock(&sem_ids(ns).mutex);



	ipc_fini_ids(ns->ids[IPC_SEM_IDS]);

	kfree(ns->ids[IPC_SEM_IDS]);

	ns->ids[IPC_SEM_IDS] = NULL;

}

ipc/shm.c

+1 −0
Original line number Diff line number Diff line
@@ -116,6 +116,7 @@ void shm_exit_ns(struct ipc_namespace *ns) 
	}

	mutex_unlock(&shm_ids(ns).mutex);



	ipc_fini_ids(ns->ids[IPC_SHM_IDS]);

	kfree(ns->ids[IPC_SHM_IDS]);

	ns->ids[IPC_SHM_IDS] = NULL;

}

ipc/util.c

+1 −1
Original line number Diff line number Diff line
@@ -301,7 +301,7 @@ static int grow_ary(struct ipc_ids* ids, int newsize) 
	 */

	rcu_assign_pointer(ids->entries, new);



	ipc_rcu_putref(old);

	__ipc_fini_ids(ids, old);

	return newsize;

}

ipc/util.h

+12 −0
Original line number Diff line number Diff line
@@ -83,6 +83,18 @@ void* ipc_rcu_alloc(int size); 
void ipc_rcu_getref(void *ptr);

void ipc_rcu_putref(void *ptr);



static inline void __ipc_fini_ids(struct ipc_ids *ids,

		struct ipc_id_ary *entries)

{

	if (entries != &ids->nullentry)

		ipc_rcu_putref(entries);

}



static inline void ipc_fini_ids(struct ipc_ids *ids)

{

	__ipc_fini_ids(ids, ids->entries);

}



struct kern_ipc_perm* ipc_get(struct ipc_ids* ids, int id);

struct kern_ipc_perm* ipc_lock(struct ipc_ids* ids, int id);

void ipc_lock_by_ptr(struct kern_ipc_perm *ipcp);

CRA Git | Maintained and supported by SUSTech CRA and CCSE