mqueue: fix kernel BUG caused by double free() on mq_open()
In case of aborting because we reach the maximum amount of memory which can be allocated to message queues per user (RLIMIT_MSGQUEUE), we would try to free the message area twice when bailing out: first by the error handling code itself, and then later when cleaning up the inode through delete_inode(). Signed-off-by: André Goddard Rosa <andre.goddard@gmail.com> Cc: Alexey Dobriyan <adobriyan@gmail.com> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: <stable@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Родитель
de145b44b9
Коммит
a3ed2a1571
|
@ -158,7 +158,7 @@ static struct inode *mqueue_get_inode(struct super_block *sb,
|
|||
u->mq_bytes + mq_bytes >
|
||||
task_rlimit(p, RLIMIT_MSGQUEUE)) {
|
||||
spin_unlock(&mq_lock);
|
||||
kfree(info->messages);
|
||||
/* mqueue_delete_inode() releases info->messages */
|
||||
goto out_inode;
|
||||
}
|
||||
u->mq_bytes += mq_bytes;
|
||||
|
|
Загрузка…
Ссылка в новой задаче