Messages in this thread Patch in this message | | | Date | Tue, 4 May 2004 17:42:15 -0700 | From | Chris Wright <> | Subject | [PATCH] fix memleak in sys_mq_timedsend |
| |
Move error handling to capture all three possible error conditions on sending to a full queue. Without this fix any unprivileged user can leak arbitrary amounts of kernel memory.
--- ./ipc/mqueue.c~fix_memleak 2004-05-04 15:08:52.000000000 -0700 +++ ./ipc/mqueue.c 2004-05-04 15:10:59.000000000 -0700 @@ -811,9 +811,9 @@ asmlinkage long sys_mq_timedsend(mqd_t m wait.msg = (void *) msg_ptr; wait.state = STATE_NONE; ret = wq_sleep(info, SEND, timeout, &wait); - if (ret < 0) - free_msg(msg_ptr); } + if (ret < 0) + free_msg(msg_ptr); } else { receiver = wq_get_first_waiter(info, RECV); if (receiver) { - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |