linux-kernel - Re: [PATCH] ipc: create_ipc_ns: drop mqueue mount on sysctl setup failure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <ooib77rqm2jfirnf6cbgefpfkutoarq3ypi4guiueuodkdns6n@yhn7n5f5ucex>
Date: Tue, 21 Oct 2025 22:42:36 +0200
From: Jan Kara <jack@...e.cz>
To: Vlad Kulikov <vlad.kulikov.c@...il.com>
Cc: Christian Brauner <brauner@...nel.org>, Jan Kara <jack@...e.cz>, 
	Andrew Morton <akpm@...ux-foundation.org>, Aleksa Sarai <cyphar@...har.com>, 
	David Hildenbrand <david@...hat.com>, Simon Schuster <schuster.simon@...mens-energy.com>, 
	Vlad Kulikov <vlad_kulikov_c@...me>, Ma Wupeng <mawupeng1@...wei.com>, 
	open list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] ipc: create_ipc_ns: drop mqueue mount on sysctl setup
 failure

On Tue 21-10-25 21:13:39, Vlad Kulikov wrote:
> If setup_mq_sysctls(ns) fails after mq_init_ns(ns) succeeds, the error
> path skipped releasing the internal kernel mqueue mount kept in
> ns->mq_mnt. That leaves the vfsmount/superblock referenced until final
> namespace teardown, i.e. a resource leak on this rare failure edge.
> 
> Unwind it by calling mntput(ns->mq_mnt) before dropping user_ns and
> freeing the IPC namespace. This mirrors the normal ordering used in
> free_ipc_ns().
> 
> Signed-off-by: Vlad Kulikov <vlad_kulikov_c@...me>

Looks good. Feel free to add:

Reviewed-by: Jan Kara <jack@...e.cz>

								Honza

> ---
>  ipc/namespace.c | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)
> 
> diff --git a/ipc/namespace.c b/ipc/namespace.c
> index 59b12fcb40bd..cf62d11a09b9 100644
> --- a/ipc/namespace.c
> +++ b/ipc/namespace.c
> @@ -75,10 +75,10 @@ static struct ipc_namespace *create_ipc_ns(struct user_namespace *user_ns,
>  
>  	err = -ENOMEM;
>  	if (!setup_mq_sysctls(ns))
> -		goto fail_put;
> +		goto fail_mq_mount;
>  
>  	if (!setup_ipc_sysctls(ns))
> -		goto fail_mq;
> +		goto fail_mq_sysctls;
>  
>  	err = msg_init_ns(ns);
>  	if (err)
> @@ -92,9 +92,10 @@ static struct ipc_namespace *create_ipc_ns(struct user_namespace *user_ns,
>  
>  fail_ipc:
>  	retire_ipc_sysctls(ns);
> -fail_mq:
> +fail_mq_sysctls:
>  	retire_mq_sysctls(ns);
> -
> +fail_mq_mount:
> +	mntput(ns->mq_mnt);
>  fail_put:
>  	put_user_ns(ns->user_ns);
>  	ns_common_free(ns);
> -- 
> 2.32.0
> 
-- 
Jan Kara <jack@...e.com>
SUSE Labs, CR