[merged mm-nonmm-stable] ipc-mqueue-release-notification-resources-during-inode-eviction.patch removed from -mm tree

[merged mm-nonmm-stable] ipc-mqueue-release-notification-resources-during-inode-eviction.patch removed from -mm tree

[Andrew Morton]

The quilt patch titled
     Subject: ipc/mqueue: release notification resources during inode eviction
has been removed from the -mm tree.  Its filename was
     ipc-mqueue-release-notification-resources-during-inode-eviction.patch

This patch was dropped because it was merged into the mm-nonmm-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

------------------------------------------------------
From: Daehyeon Ko <4ncienth@gmail.com>
Subject: ipc/mqueue: release notification resources during inode eviction
Date: Mon, 24 Aug 2026 13:23:59 +0900

mqueue_flush_file() removes an mq_notify() registration only when the
closing task belongs to the thread group stored in notify_owner.

A task in a separate thread group created with CLONE_FILES can register
SIGEV_THREAD notification and exit without closing the shared file table. 
If another thread group then unlinks and last-closes the queue, ->flush()
skips the registration and inode eviction loses the only pointers to its
resources.

The orphaned registration permanently retains the notification skb, its
netlink socket, a pid reference and a user namespace reference.  An
unprivileged process can repeat the sequence with new queues and sockets.

No inode users remain during eviction.  Remove any stale registration
there after dropping info->lock, since netlink_sendskb() may release the
final socket reference.

This bug creates an unkillable kernel resource leak by failing to free
netlink socket, PID, and user namespace references when a POSIX message
queue is evicted.  An unprivileged process can exploit this leak
repeatedly to cause kernel memory exhaustion and lead to a DoS.

Link: https://lore.kernel.org/20260824042359.925145-1-4ncienth@gmail.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Assisted-by: LLM
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Jan Kara <jack@suse.cz>
Cc: Manfred Spraul <manfred@colorfullife.com>
Cc: NeilBrown <neil@brown.name>
Cc: <stable@vger.kernel.org>
---

 ipc/mqueue.c |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/ipc/mqueue.c~ipc-mqueue-release-notification-resources-during-inode-eviction
+++ a/ipc/mqueue.c
@@ -528,6 +528,13 @@ static void mqueue_evict_inode(struct in
 		list_add_tail(&msg->m_list, &tmp_msg);
 	kfree(info->node_cache);
 	spin_unlock(&info->lock);
+	/*
+	 * A shared file table can let the notification owner exit without
+	 * running ->flush(). No users of the inode remain during eviction, so
+	 * tear down any stale notification after dropping info->lock because
+	 * netlink_sendskb() may release the final socket reference.
+	 */
+	remove_notification(info);
 
 	list_for_each_entry_safe(msg, nmsg, &tmp_msg, m_list) {
 		list_del(&msg->m_list);
_

Patches currently in -mm which might be from 4ncienth@gmail.com are

assoc_array-discard-shortcut-when-collapsing-a-leaf-only-node.patch