Re: [PATCH] ipc/mqueue: release notification resources during inode eviction

[Andrew Morton]

On Mon, 24 Aug 2026 13:23:59 +0900 Daehyeon Ko <4ncienth@xxxxxxxxx> wrote:

> mqueue_flush_file() removes an mq_notify() registration only when the
> closing task belongs to the thread group stored in notify_owner.
> 
> A task in a separate thread group created with CLONE_FILES can register
> SIGEV_THREAD notification and exit without closing the shared file table.
> If another thread group then unlinks and last-closes the queue, ->flush()
> skips the registration and inode eviction loses the only pointers to its
> resources.
> 
> The orphaned registration permanently retains the notification skb, its
> netlink socket, a pid reference and a user namespace reference. An
> unprivileged process can repeat the sequence with new queues and sockets.
> 
> No inode users remain during eviction. Remove any stale registration there
> after dropping info->lock, since netlink_sendskb() may release the final
> socket reference.

Thanks.

> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@xxxxxxxxxxxxxxx

Pity the poor -stable maintainers (and others downstream from them)
wondering "why was I sent this".

To answer this, please, in all bugfix changelogs, provide a concise
description of the userspace-visible runtime effects of the bug.

I asked Gemini that exact question and was told

  This bug creates an unkillable kernel resource leak by failing to
  free netlink socket, PID, and user namespace references when a POSIX
  message queue is evicted.  An unprivileged process can exploit this
  leak repeatedly to cause kernel memory exhaustion and lead to a
  Denial of Service (DoS).

which I'll paste into the changelog.

> Assisted-by: LLM

OK ;)

> A reproducer and regression selftest are available on request.
> 
> Tested on x86_64 KASAN at the stated base. The unpatched oracle reproduced
> 3/3 and the patched oracle passed 3/3, with no KASAN report, WARNING splat,
> Oops or panic.

Useful info, thanks for including.