Commit be4d250a authored by Xiaotian Feng's avatar Xiaotian Feng Committed by Linus Torvalds

ipcns: fix use after free in free_ipc_ns()

commit b515498f ("userns: add a user namespace owner of ipc ns") added a
user namespace owner of ipc ns, but it also introduced a use after free in
free_ipc_ns().
Signed-off-by: default avatarXiaotian Feng <dfeng@redhat.com>
Acked-by: default avatar"Serge E. Hallyn" <serge.hallyn@canonical.com>
Acked-by: default avatarDavid Howells <dhowells@redhat.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Daniel Lezcano <daniel.lezcano@free.fr>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent c03e3126
...@@ -104,7 +104,6 @@ static void free_ipc_ns(struct ipc_namespace *ns) ...@@ -104,7 +104,6 @@ static void free_ipc_ns(struct ipc_namespace *ns)
sem_exit_ns(ns); sem_exit_ns(ns);
msg_exit_ns(ns); msg_exit_ns(ns);
shm_exit_ns(ns); shm_exit_ns(ns);
kfree(ns);
atomic_dec(&nr_ipc_ns); atomic_dec(&nr_ipc_ns);
/* /*
...@@ -113,6 +112,7 @@ static void free_ipc_ns(struct ipc_namespace *ns) ...@@ -113,6 +112,7 @@ static void free_ipc_ns(struct ipc_namespace *ns)
*/ */
ipcns_notify(IPCNS_REMOVED); ipcns_notify(IPCNS_REMOVED);
put_user_ns(ns->user_ns); put_user_ns(ns->user_ns);
kfree(ns);
} }
/* /*
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment