github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ipc/mqueue: release notification resources during inode eviction

Browse Source 
mqueue_flush_file() removes an mq_notify() registration only when the
closing task belongs to the thread group stored in notify_owner.

A task in a separate thread group created with CLONE_FILES can register
SIGEV_THREAD notification and exit without closing the shared file table. 
If another thread group then unlinks and last-closes the queue, ->flush()
skips the registration and inode eviction loses the only pointers to its
resources.

The orphaned registration permanently retains the notification skb, its
netlink socket, a pid reference and a user namespace reference.  An
unprivileged process can repeat the sequence with new queues and sockets.

No inode users remain during eviction.  Remove any stale registration
there after dropping info->lock, since netlink_sendskb() may release the
final socket reference.

This bug creates an unkillable kernel resource leak by failing to free
netlink socket, PID, and user namespace references when a POSIX message
queue is evicted.  An unprivileged process can exploit this leak
repeatedly to cause kernel memory exhaustion and lead to a DoS.

Link: https://lore.kernel.org/20260824042359.925145-1-4ncienth@gmail.com
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Assisted-by: LLM
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Jan Kara <jack@suse.cz>
Cc: Manfred Spraul <manfred@colorfullife.com>
Cc: NeilBrown <neil@brown.name>
Cc: <stable@vger.kernel.org>
This commit is contained in:
Daehyeon Ko 2026-08-24 13:23:59 +09:00 committed by Andrew Morton
parent cba342dde1
commit 34dbdb7e23
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ipc/mqueue.c
View File

@ -528,6 +528,13 @@ static void mqueue_evict_inode(struct inode *inode)
list_add_tail(&msg->m_list, &tmp_msg);
kfree(info->node_cache);
spin_unlock(&info->lock);
/*
* A shared file table can let the notification owner exit without
* running ->flush(). No users of the inode remain during eviction, so
* tear down any stale notification after dropping info->lock because
* netlink_sendskb() may release the final socket reference.
*/
remove_notification(info);
list_for_each_entry_safe(msg, nmsg, &tmp_msg, m_list) {
list_del(&msg->m_list);