* [patch -next] ipcns: use after free in free_ipc_ns()
@ 2011-03-28 8:50 Dan Carpenter
2011-03-28 11:55 ` Eric W. Biederman
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2011-03-28 8:50 UTC (permalink / raw)
To: Andrew Morton
Cc: serge, Eric W. Biederman, David Howells, Daniel Lezcano,
linux-kernel, kernel-janitors
We dereference "ns" after it has been freed. This was introduced in
b515498f5bb5 "userns: add a user namespace owner of ipc ns".
Signed-off-by: Dan Carpenter <error27@gmail.com>
diff --git a/ipc/namespace.c b/ipc/namespace.c
index 3c3e522..8054c8e 100644
--- a/ipc/namespace.c
+++ b/ipc/namespace.c
@@ -104,7 +104,6 @@ static void free_ipc_ns(struct ipc_namespace *ns)
sem_exit_ns(ns);
msg_exit_ns(ns);
shm_exit_ns(ns);
- kfree(ns);
atomic_dec(&nr_ipc_ns);
/*
@@ -113,6 +112,7 @@ static void free_ipc_ns(struct ipc_namespace *ns)
*/
ipcns_notify(IPCNS_REMOVED);
put_user_ns(ns->user_ns);
+ kfree(ns);
}
/*
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [patch -next] ipcns: use after free in free_ipc_ns()
2011-03-28 8:50 [patch -next] ipcns: use after free in free_ipc_ns() Dan Carpenter
@ 2011-03-28 11:55 ` Eric W. Biederman
0 siblings, 0 replies; 2+ messages in thread
From: Eric W. Biederman @ 2011-03-28 11:55 UTC (permalink / raw)
To: Dan Carpenter
Cc: Andrew Morton, serge, David Howells, Daniel Lezcano, linux-kernel,
kernel-janitors
Dan Carpenter <error27@gmail.com> writes:
> We dereference "ns" after it has been freed. This was introduced in
> b515498f5bb5 "userns: add a user namespace owner of ipc ns".
I think Andrew has already merged this fix.
>
> Signed-off-by: Dan Carpenter <error27@gmail.com>
>
> diff --git a/ipc/namespace.c b/ipc/namespace.c
> index 3c3e522..8054c8e 100644
> --- a/ipc/namespace.c
> +++ b/ipc/namespace.c
> @@ -104,7 +104,6 @@ static void free_ipc_ns(struct ipc_namespace *ns)
> sem_exit_ns(ns);
> msg_exit_ns(ns);
> shm_exit_ns(ns);
> - kfree(ns);
> atomic_dec(&nr_ipc_ns);
>
> /*
> @@ -113,6 +112,7 @@ static void free_ipc_ns(struct ipc_namespace *ns)
> */
> ipcns_notify(IPCNS_REMOVED);
> put_user_ns(ns->user_ns);
> + kfree(ns);
> }
>
> /*
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2011-03-28 11:55 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-03-28 8:50 [patch -next] ipcns: use after free in free_ipc_ns() Dan Carpenter
2011-03-28 11:55 ` Eric W. Biederman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox