summaryrefslogtreecommitdiff
path: root/ipc
diff options
context:
space:
mode:
authorAndré Goddard Rosa <andre.goddard@gmail.com>2010-05-11 14:07:03 -0700
committerLinus Torvalds <torvalds@linux-foundation.org>2010-05-11 17:33:42 -0700
commita3ed2a15719219769bb095b28009c1d654a419e8 (patch)
tree22039574b16ad79f9eba06317e8f1ad7cd9d53c3 /ipc
parentde145b44b95b9d3212a82d1c0f29b09778ef33c5 (diff)
mqueue: fix kernel BUG caused by double free() on mq_open()
In case of aborting because we reach the maximum amount of memory which can be allocated to message queues per user (RLIMIT_MSGQUEUE), we would try to free the message area twice when bailing out: first by the error handling code itself, and then later when cleaning up the inode through delete_inode(). Signed-off-by: André Goddard Rosa <andre.goddard@gmail.com> Cc: Alexey Dobriyan <adobriyan@gmail.com> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: <stable@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'ipc')
-rw-r--r--ipc/mqueue.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index 722b0130aa94..59a009dc54a8 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -158,7 +158,7 @@ static struct inode *mqueue_get_inode(struct super_block *sb,
u->mq_bytes + mq_bytes >
task_rlimit(p, RLIMIT_MSGQUEUE)) {
spin_unlock(&mq_lock);
- kfree(info->messages);
+ /* mqueue_delete_inode() releases info->messages */
goto out_inode;
}
u->mq_bytes += mq_bytes;