| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <1301034504-8133-1-git-send-email-dfeng@redhat.com> Date: Fri, 25 Mar 2011 14:28:24 +0800 From: Xiaotian Feng <dfeng@...hat.com> To: linux-kernel@...r.kernel.org Cc: Xiaotian Feng <dfeng@...hat.com>, Andrew Morton <akpm@...ux-foundation.org>, "Serge E. Hallyn" <serge.hallyn@...onical.com>, "Eric W. Biederman" <ebiederm@...ssion.com>, David Howells <dhowells@...hat.com>, Daniel Lezcano <daniel.lezcano@...e.fr> Subject: [PATCH] ipcns: fix use after free in free_ipc_ns commit b515498 add a user namespace owner of ipc ns, but it also introduced a use after free in free_ipc_ns. Signed-off-by: Xiaotian Feng <dfeng@...hat.com> Cc: Andrew Morton <akpm@...ux-foundation.org> Cc: "Serge E. Hallyn" <serge.hallyn@...onical.com> Cc: "Eric W. Biederman" <ebiederm@...ssion.com> Cc: David Howells <dhowells@...hat.com> Cc: Daniel Lezcano <daniel.lezcano@...e.fr> --- ipc/namespace.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/ipc/namespace.c b/ipc/namespace.c index 3c3e522..8054c8e 100644 --- a/ipc/namespace.c +++ b/ipc/namespace.c @@ -104,7 +104,6 @@ static void free_ipc_ns(struct ipc_namespace *ns) sem_exit_ns(ns); msg_exit_ns(ns); shm_exit_ns(ns); - kfree(ns); atomic_dec(&nr_ipc_ns); /* @@ -113,6 +112,7 @@ static void free_ipc_ns(struct ipc_namespace *ns) */ ipcns_notify(IPCNS_REMOVED); put_user_ns(ns->user_ns); + kfree(ns); } /* -- 1.7.1 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists