[PATCH] Fix ipc entries removal

Fix two issuses related to ipc_ids->entries freeing.

1. When freeing ipc namespace we need to free entries allocated
   with ipc_init_ids().

2. When removing old entries in grow_ary() ipc_rcu_putref()
   may be called on entries set to &ids->nullentry earlier in
   ipc_init_ids().
   This is almost impossible without namespaces, but with
   them this situation becomes possible.

Found during OpenVZ testing after obvious leaks in beancounters.

Signed-off-by: Pavel Emelianov <xemul@openvz.org>
Cc: Kirill Korotaev <dev@openvz.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

diff --git a/ipc/msg.c b/ipc/msg.c
index 5b213d952545e82684dc1d3f212f311ad3348790..600e06f943a67eb5539d372d945009ae0b1d3e36 100644 (file)
--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -124,6 +124,7 @@ void msg_exit_ns(struct ipc_namespace *ns)
        }
        mutex_unlock(&msg_ids(ns).mutex);
 
+       ipc_fini_ids(ns->ids[IPC_MSG_IDS]);
        kfree(ns->ids[IPC_MSG_IDS]);
        ns->ids[IPC_MSG_IDS] = NULL;
 }

diff --git a/ipc/sem.c b/ipc/sem.c
index 0dafcc455f920888fe13a474b926ad0bd6825a11..21b3289d640c1eb0989457f42f1eb4b62b675aff 100644 (file)
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -161,6 +161,7 @@ void sem_exit_ns(struct ipc_namespace *ns)
        }
        mutex_unlock(&sem_ids(ns).mutex);
 
+       ipc_fini_ids(ns->ids[IPC_SEM_IDS]);
        kfree(ns->ids[IPC_SEM_IDS]);
        ns->ids[IPC_SEM_IDS] = NULL;
 }

diff --git a/ipc/shm.c b/ipc/shm.c
index bfbd317ec11c0be1a73bc85b82d37ee3bbf33dd3..d1198dd07a1a2294ae8eb25e44eecfc3e902070f 100644 (file)
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -116,6 +116,7 @@ void shm_exit_ns(struct ipc_namespace *ns)
        }
        mutex_unlock(&shm_ids(ns).mutex);
 
+       ipc_fini_ids(ns->ids[IPC_SHM_IDS]);
        kfree(ns->ids[IPC_SHM_IDS]);
        ns->ids[IPC_SHM_IDS] = NULL;
 }

diff --git a/ipc/util.c b/ipc/util.c
index 42479e4eec5935b808a198acd34285dae69f2618..cd8bb14a431f648a1327b3e84deb338e806b6a60 100644 (file)
--- a/ipc/util.c
+++ b/ipc/util.c
@@ -301,7 +301,7 @@ static int grow_ary(struct ipc_ids* ids, int newsize)
         */
        rcu_assign_pointer(ids->entries, new);
 
-       ipc_rcu_putref(old);
+       __ipc_fini_ids(ids, old);
        return newsize;
 }
 

diff --git a/ipc/util.h b/ipc/util.h
index c8fd6b9d77b5e0bfddcae8b2bbf5f40d6ae4ea03..e3aa2c5c97dc1f996add0ba9e2827c8cca8d7b28 100644 (file)
--- a/ipc/util.h
+++ b/ipc/util.h
@@ -83,6 +83,18 @@ void* ipc_rcu_alloc(int size);
 void ipc_rcu_getref(void *ptr);
 void ipc_rcu_putref(void *ptr);
 
+static inline void __ipc_fini_ids(struct ipc_ids *ids,
+               struct ipc_id_ary *entries)
+{
+       if (entries != &ids->nullentry)
+               ipc_rcu_putref(entries);
+}
+
+static inline void ipc_fini_ids(struct ipc_ids *ids)
+{
+       __ipc_fini_ids(ids, ids->entries);
+}
+
 struct kern_ipc_perm* ipc_get(struct ipc_ids* ids, int id);
 struct kern_ipc_perm* ipc_lock(struct ipc_ids* ids, int id);
 void ipc_lock_by_ptr(struct kern_ipc_perm *ipcp);