linux-kernel - [PATCH] ipc ns: fix memory leak (idr)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Fri, 9 Oct 2009 17:25:31 -0500
From:	"Serge E. Hallyn" <serue@...ibm.com>
To:	lkml <linux-kernel@...r.kernel.org>
Cc:	Linux Containers <containers@...ts.osdl.org>,
	Nadia Derbey <Nadia.Derbey@...l.net>
Subject: [PATCH] ipc ns: fix memory leak (idr)

We have apparently had a memory leak since
7ca7e564e049d8b350ec9d958ff25eaa24226352
"ipc: store ipcs into IDRs" in 2007.  The idr of which 3
exist for each ipc namespace is never freed.

This patch simply frees them when the ipcns is freed.  I don't
believe any idr_remove() are done from rcu (and could therefore
be delayed until after this idr_destroy()), so the patch should
be safe.  Some quick testing showed no harm, and the memory
leak fixed.

Caught by kmemleak.

Signed-off-by: Serge E. Hallyn <serue@...ibm.com>
---
 ipc/msg.c |    1 +
 ipc/sem.c |    1 +
 ipc/shm.c |    1 +
 3 files changed, 3 insertions(+), 0 deletions(-)

diff --git a/ipc/msg.c b/ipc/msg.c
index 3559d53..861cc32 100644
--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -124,6 +124,7 @@ void msg_init_ns(struct ipc_namespace *ns)
 void msg_exit_ns(struct ipc_namespace *ns)
 {
 	free_ipcs(ns, &msg_ids(ns), freeque);
+	idr_destroy(&ns->ids[IPC_MSG_IDS].ipcs_idr);
 }
 #endif
 
diff --git a/ipc/sem.c b/ipc/sem.c
index 7361041..23ce7ec 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -128,6 +128,7 @@ void sem_init_ns(struct ipc_namespace *ns)
 void sem_exit_ns(struct ipc_namespace *ns)
 {
 	free_ipcs(ns, &sem_ids(ns), freeary);
+	idr_destroy(&ns->ids[IPC_SEM_IDS].ipcs_idr);
 }
 #endif
 
diff --git a/ipc/shm.c b/ipc/shm.c
index 26f9253..82ab773 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -102,6 +102,7 @@ void do_shm_rmid(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp)
 void shm_exit_ns(struct ipc_namespace *ns)
 {
 	free_ipcs(ns, &shm_ids(ns), do_shm_rmid);
+	idr_destroy(&ns->ids[IPC_SHM_IDS].ipcs_idr);
 }
 #endif
 
-- 
1.5.4.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/