The patch titled
Fix ipc entries removal
has been added to the -mm tree. Its filename is
fix-ipc-entries-removal.patch
See http://www.zip.com.au/~akpm/linux/patches/stuff/added-to-mm.txt to find
out what to do about this
------------------------------------------------------
Subject: Fix ipc entries removal
From: Pavel Emelianov <xemul@xxxxxxxxxx>
Fix two issuses related to ipc_ids->entries freeing.
1. When freeing ipc namespace we need to free entries allocated
with ipc_init_ids().
2. When removing old entries in grow_ary() ipc_rcu_putref()
may be called on entries set to &ids->nullentry earlier in
ipc_init_ids().
This is almost impossible without namespaces, but with
them this situation becomes possible.
Found during OpenVZ testing after obvious leaks in beancounters.
Signed-off-by: Pavel Emelianov <xemul@xxxxxxxxxx>
Cc: Kirill Korotaev <dev@xxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxx>
---
ipc/msg.c | 1 +
ipc/sem.c | 1 +
ipc/shm.c | 1 +
ipc/util.c | 2 +-
ipc/util.h | 12 ++++++++++++
5 files changed, 16 insertions(+), 1 deletion(-)
diff -puN ipc/msg.c~fix-ipc-entries-removal ipc/msg.c
--- a/ipc/msg.c~fix-ipc-entries-removal
+++ a/ipc/msg.c
@@ -124,6 +124,7 @@ void msg_exit_ns(struct ipc_namespace *n
}
mutex_unlock(&msg_ids(ns).mutex);
+ ipc_fini_ids(ns->ids[IPC_MSG_IDS]);
kfree(ns->ids[IPC_MSG_IDS]);
ns->ids[IPC_MSG_IDS] = NULL;
}
diff -puN ipc/sem.c~fix-ipc-entries-removal ipc/sem.c
--- a/ipc/sem.c~fix-ipc-entries-removal
+++ a/ipc/sem.c
@@ -161,6 +161,7 @@ void sem_exit_ns(struct ipc_namespace *n
}
mutex_unlock(&sem_ids(ns).mutex);
+ ipc_fini_ids(ns->ids[IPC_SEM_IDS]);
kfree(ns->ids[IPC_SEM_IDS]);
ns->ids[IPC_SEM_IDS] = NULL;
}
diff -puN ipc/shm.c~fix-ipc-entries-removal ipc/shm.c
--- a/ipc/shm.c~fix-ipc-entries-removal
+++ a/ipc/shm.c
@@ -116,6 +116,7 @@ void shm_exit_ns(struct ipc_namespace *n
}
mutex_unlock(&shm_ids(ns).mutex);
+ ipc_fini_ids(ns->ids[IPC_SHM_IDS]);
kfree(ns->ids[IPC_SHM_IDS]);
ns->ids[IPC_SHM_IDS] = NULL;
}
diff -puN ipc/util.c~fix-ipc-entries-removal ipc/util.c
--- a/ipc/util.c~fix-ipc-entries-removal
+++ a/ipc/util.c
@@ -301,7 +301,7 @@ static int grow_ary(struct ipc_ids* ids,
*/
rcu_assign_pointer(ids->entries, new);
- ipc_rcu_putref(old);
+ __ipc_fini_ids(ids, old);
return newsize;
}
diff -puN ipc/util.h~fix-ipc-entries-removal ipc/util.h
--- a/ipc/util.h~fix-ipc-entries-removal
+++ a/ipc/util.h
@@ -83,6 +83,18 @@ void* ipc_rcu_alloc(int size);
void ipc_rcu_getref(void *ptr);
void ipc_rcu_putref(void *ptr);
+static inline void __ipc_fini_ids(struct ipc_ids *ids,
+ struct ipc_id_ary *entries)
+{
+ if (entries != &ids->nullentry)
+ ipc_rcu_putref(entries);
+}
+
+static inline void ipc_fini_ids(struct ipc_ids *ids)
+{
+ __ipc_fini_ids(ids, ids->entries);
+}
+
struct kern_ipc_perm* ipc_get(struct ipc_ids* ids, int id);
struct kern_ipc_perm* ipc_lock(struct ipc_ids* ids, int id);
void ipc_lock_by_ptr(struct kern_ipc_perm *ipcp);
_
Patches currently in -mm which might be from xemul@xxxxxxxxxx are
fix-ipc-entries-removal.patch
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
