Dan Carpenter <error27@xxxxxxxxx> writes: > We dereference "ns" after it has been freed. This was introduced in > b515498f5bb5 "userns: add a user namespace owner of ipc ns". I think Andrew has already merged this fix. > > Signed-off-by: Dan Carpenter <error27@xxxxxxxxx> > > diff --git a/ipc/namespace.c b/ipc/namespace.c > index 3c3e522..8054c8e 100644 > --- a/ipc/namespace.c > +++ b/ipc/namespace.c > @@ -104,7 +104,6 @@ static void free_ipc_ns(struct ipc_namespace *ns) > sem_exit_ns(ns); > msg_exit_ns(ns); > shm_exit_ns(ns); > - kfree(ns); > atomic_dec(&nr_ipc_ns); > > /* > @@ -113,6 +112,7 @@ static void free_ipc_ns(struct ipc_namespace *ns) > */ > ipcns_notify(IPCNS_REMOVED); > put_user_ns(ns->user_ns); > + kfree(ns); > } > > /* -- To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
