[PATCH] ipc/mqueue: remove pending notification in mqueue_evict_inode()

[Hui Peng]

When a process registers a notification via mq_notify(), do_mq_notify()
takes references on info->notify_owner (struct pid) and
info->notify_user_ns (struct user_namespace), and for SIGEV_THREAD
notifications also allocates a 32-byte kernel sk_buff
(info->notify_cookie) charged via netlink_attachskb() to
info->notify_sock (struct sock).

mqueue_flush_file() only calls remove_notification(info) when the
process closing the descriptor has task_tgid(current) ==
info->notify_owner. When a child process created with CLONE_FILES (and
its own TGID) registers a notification via mq_notify() and exits while
the parent still holds the shared file table, exit_files() drops the
child's files_struct reference without calling filp_close(). When the
parent subsequently closes the descriptor and unlinks the queue,
task_tgid(current) != info->notify_owner in mqueue_flush_file(), so the
notification remains active when mqueue_evict_inode() is called.

Because mqueue_evict_inode() does not call remove_notification(info),
the attached sk_buff (and its sk_rmem_alloc charge on the netlink
socket), sock reference, pid reference, and user_namespace reference are
permanently leaked when the inode is evicted.

Call remove_notification(info) in mqueue_evict_inode() if
info->notify_owner is non-NULL.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@xxxxxxxxx>

---
 ipc/mqueue.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index d1dd36a651b0..a49b7574e008 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -526,6 +526,8 @@ static void mqueue_evict_inode(struct inode *inode)
 	spin_lock(&info->lock);
 	while ((msg = msg_get(info)) != NULL)
 		list_add_tail(&msg->m_list, &tmp_msg);
+	if (info->notify_owner)
+		remove_notification(info);
 	kfree(info->node_cache);
 	spin_unlock(&info->lock);
 
-- 
2.55.0.1082.g2b9226bbc0-goog