leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[PATCH] Fix ipc entries removal

Browse Source 
Fix two issuses related to ipc_ids->entries freeing.

1. When freeing ipc namespace we need to free entries allocated
   with ipc_init_ids().

2. When removing old entries in grow_ary() ipc_rcu_putref()
   may be called on entries set to &ids->nullentry earlier in
   ipc_init_ids().
   This is almost impossible without namespaces, but with
   them this situation becomes possible.

Found during OpenVZ testing after obvious leaks in beancounters.

Signed-off-by: Pavel Emelianov <xemul@openvz.org>
Cc: Kirill Korotaev <dev@openvz.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
Pavel Emelianov 2006-11-02 22:07:03 -08:00 committed by Linus Torvalds
parent 733b72c31e
commit c7e12b8389
5 changed files with 16 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
ipc/msg.c
View File

@ -124,6 +124,7 @@ void msg_exit_ns(struct ipc_namespace *ns)
} }
mutex_unlock(&msg_ids(ns).mutex); mutex_unlock(&msg_ids(ns).mutex);
ipc_fini_ids(ns->ids[IPC_MSG_IDS]);
kfree(ns->ids[IPC_MSG_IDS]); kfree(ns->ids[IPC_MSG_IDS]);
ns->ids[IPC_MSG_IDS] = NULL; ns->ids[IPC_MSG_IDS] = NULL;
} }

1
ipc/sem.c
View File

@ -161,6 +161,7 @@ void sem_exit_ns(struct ipc_namespace *ns)
} }
mutex_unlock(&sem_ids(ns).mutex); mutex_unlock(&sem_ids(ns).mutex);
ipc_fini_ids(ns->ids[IPC_SEM_IDS]);
kfree(ns->ids[IPC_SEM_IDS]); kfree(ns->ids[IPC_SEM_IDS]);
ns->ids[IPC_SEM_IDS] = NULL; ns->ids[IPC_SEM_IDS] = NULL;
} }

1
ipc/shm.c
View File

@ -116,6 +116,7 @@ void shm_exit_ns(struct ipc_namespace *ns)
} }
mutex_unlock(&shm_ids(ns).mutex); mutex_unlock(&shm_ids(ns).mutex);
ipc_fini_ids(ns->ids[IPC_SHM_IDS]);
kfree(ns->ids[IPC_SHM_IDS]); kfree(ns->ids[IPC_SHM_IDS]);
ns->ids[IPC_SHM_IDS] = NULL; ns->ids[IPC_SHM_IDS] = NULL;
} }

2
ipc/util.c
View File

@ -301,7 +301,7 @@ static int grow_ary(struct ipc_ids* ids, int newsize)
*/ */
rcu_assign_pointer(ids->entries, new); rcu_assign_pointer(ids->entries, new);
ipc_rcu_putref(old); __ipc_fini_ids(ids, old);
return newsize; return newsize;
} }

12
ipc/util.h
View File

@ -83,6 +83,18 @@ void* ipc_rcu_alloc(int size);
void ipc_rcu_getref(void *ptr); void ipc_rcu_getref(void *ptr);
void ipc_rcu_putref(void *ptr); void ipc_rcu_putref(void *ptr);
static inline void __ipc_fini_ids(struct ipc_ids *ids,
struct ipc_id_ary *entries)
{
if (entries != &ids->nullentry)
ipc_rcu_putref(entries);
}
static inline void ipc_fini_ids(struct ipc_ids *ids)
{
__ipc_fini_ids(ids, ids->entries);
}
struct kern_ipc_perm* ipc_get(struct ipc_ids* ids, int id); struct kern_ipc_perm* ipc_get(struct ipc_ids* ids, int id);
struct kern_ipc_perm* ipc_lock(struct ipc_ids* ids, int id); struct kern_ipc_perm* ipc_lock(struct ipc_ids* ids, int id);
void ipc_lock_by_ptr(struct kern_ipc_perm *ipcp); void ipc_lock_by_ptr(struct kern_ipc_perm *ipcp);