• Alexey Gladkov's avatar
    ipc: Free mq_sysctls if ipc namespace creation failed · db7cfc38
    Alexey Gladkov authored
    The problem that Dmitry Vyukov pointed out is that if setup_ipc_sysctls fails,
    mq_sysctls must be freed before return.
    
    executing program
    BUG: memory leak
    unreferenced object 0xffff888112fc9200 (size 512):
      comm "syz-executor237", pid 3648, jiffies 4294970469 (age 12.270s)
      hex dump (first 32 bytes):
        ef d3 60 85 ff ff ff ff 0c 9b d2 12 81 88 ff ff  ..`.............
        04 00 00 00 a4 01 00 00 00 00 00 00 00 00 00 00  ................
      backtrace:
        [<ffffffff814b6eb3>] kmemdup+0x23/0x50 mm/util.c:129
        [<ffffffff82219a9b>] kmemdup include/linux/fortify-string.h:456 [inline]
        [<ffffffff82219a9b>] setup_mq_sysctls+0x4b/0x1c0 ipc/mq_sysctl.c:89
        [<ffffffff822197f2>] create_ipc_ns ipc/namespace.c:63 [inline]
        [<ffffffff822197f2>] copy_ipcs+0x292/0x390 ipc/namespace.c:91
        [<ffffffff8127de7c>] create_new_namespaces+0xdc/0x4f0 kernel/nsproxy.c:90
        [<ffffffff8127e89b>] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:226
        [<ff...
    db7cfc38
namespace.c 5.31 KB