Skip to main content

Browse the archive

Revision a3ed2a15719219769bb095b28009c1d654a419e8 authored by André Goddard Rosa on 11 May 2010, 21:07:03 UTC, committed by Linus Torvalds on 12 May 2010, 00:33:42 UTC 
mqueue: fix kernel BUG caused by double free() on mq_open()
 
In case of aborting because we reach the maximum amount of memory which
can be allocated to message queues per user (RLIMIT_MSGQUEUE), we would
try to free the message area twice when bailing out: first by the error
handling code itself, and then later when cleaning up the inode through
delete_inode().

Signed-off-by: André Goddard Rosa <andre.goddard@gmail.com>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent de145b4
Raw File
msgbuf.h 
/*
 * include/asm-xtensa/msgbuf.h
 *
 * The msqid64_ds structure for the Xtensa architecture.
 * Note extra padding because this structure is passed back and forth
 * between kernel and user space.
 *
 * Pad space is left for:
 * - 64-bit time_t to solve y2038 problem
 * - 2 miscellaneous 32-bit values
 *
 * This file is subject to the terms and conditions of the GNU General
 * Public License.  See the file "COPYING" in the main directory of
 * this archive for more details.
 */

#ifndef _XTENSA_MSGBUF_H
#define _XTENSA_MSGBUF_H

struct msqid64_ds {
	struct ipc64_perm msg_perm;
#ifdef __XTENSA_EB__
	unsigned int	__unused1;
	__kernel_time_t msg_stime;	/* last msgsnd time */
	unsigned int	__unused2;
	__kernel_time_t msg_rtime;	/* last msgrcv time */
	unsigned int	__unused3;
	__kernel_time_t msg_ctime;	/* last change time */
#elif defined(__XTENSA_EL__)
	__kernel_time_t msg_stime;	/* last msgsnd time */
	unsigned int	__unused1;
	__kernel_time_t msg_rtime;	/* last msgrcv time */
	unsigned int	__unused2;
	__kernel_time_t msg_ctime;	/* last change time */
	unsigned int	__unused3;
#else
# error processor byte order undefined!
#endif
	unsigned long  msg_cbytes;	/* current number of bytes on queue */
	unsigned long  msg_qnum;	/* number of messages in queue */
	unsigned long  msg_qbytes;	/* max number of bytes on queue */
	__kernel_pid_t msg_lspid;	/* pid of last msgsnd */
	__kernel_pid_t msg_lrpid;	/* last receive pid */
	unsigned long  __unused4;
	unsigned long  __unused5;
};

#endif	/* _XTENSA_MSGBUF_H */
back to top