diff options
| author | Xiaotian Feng <dfeng@redhat.com> | 2011-03-25 11:57:01 +0300 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2011-03-26 03:45:16 +0300 |
| commit | be4d250ab41e13f8f945be6896695e870b38ba31 (patch) | |
| tree | a4c47d13bbd91ba05870f457b8063829ca81134f /ipc | |
| parent | c03e3126e4f9535f4983d727f036440255c43c82 (diff) | |
| download | linux-be4d250ab41e13f8f945be6896695e870b38ba31.tar.xz | |
ipcns: fix use after free in free_ipc_ns()
commit b515498 ("userns: add a user namespace owner of ipc ns") added a
user namespace owner of ipc ns, but it also introduced a use after free in
free_ipc_ns().
Signed-off-by: Xiaotian Feng <dfeng@redhat.com>
Acked-by: "Serge E. Hallyn" <serge.hallyn@canonical.com>
Acked-by: David Howells <dhowells@redhat.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Daniel Lezcano <daniel.lezcano@free.fr>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'ipc')
| -rw-r--r-- | ipc/namespace.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/ipc/namespace.c b/ipc/namespace.c index 3c3e5223e7e5..8054c8e5faf1 100644 --- a/ipc/namespace.c +++ b/ipc/namespace.c @@ -104,7 +104,6 @@ static void free_ipc_ns(struct ipc_namespace *ns) sem_exit_ns(ns); msg_exit_ns(ns); shm_exit_ns(ns); - kfree(ns); atomic_dec(&nr_ipc_ns); /* @@ -113,6 +112,7 @@ static void free_ipc_ns(struct ipc_namespace *ns) */ ipcns_notify(IPCNS_REMOVED); put_user_ns(ns->user_ns); + kfree(ns); } /* |