mq_init_ns() creates the mqueue mount with fc_mount_longterm(), so its
->mnt_ns is MNT_NS_INTERNAL. When setting up the mqueue or ipc sysctls
or msg_init_ns() fails afterwards, create_ipc_ns() drops it with a plain
mntput(). With ->mnt_ns set that takes the fast path of
mntput_no_expire(). The count drops to zero and nothing ever kills the
mount, so the mount and the mqueue superblock are leaked.
Commit dc55e35f9e81 ("ipc: Store mqueue sysctls in the ipc namespace")
added the first failure path after mq_init_ns() and never dropped the
mount. Commit 7229d74e5e8c ("ipc: create_ipc_ns: drop mqueue mount on
sysctl setup failure") tried to fix that with a mntput() but that
doesn't help for a long-term mount.
Use kern_unmount(). free_ipc() open-codes the same thing for a namespace
that made it.
Fixes: dc55e35f9e81 ("ipc: Store mqueue sysctls in the ipc namespace")
Fixes: 7229d74e5e8c ("ipc: create_ipc_ns: drop mqueue mount on sysctl setup
failure")
Cc: [email protected]
Signed-off-by: Christian Brauner (Amutable) <[email protected]>
---
Reproducer: repro.c fails each slab allocation of unshare(CLONE_NEWIPC)
in turn with fail-nth, a hundred rounds. It needs CONFIG_FAILSLAB and
CONFIG_FAULT_INJECTION_DEBUG_FS and runs as root.
echo N > /sys/kernel/debug/failslab/ignore-gfp-wait
echo 0 > /sys/kernel/debug/failslab/verbose
echo 2 > /proc/sys/vm/drop_caches; cat /proc/sys/fs/inode-nr
./repro 100
sleep 2
echo 2 > /proc/sys/vm/drop_caches; cat /proc/sys/fs/inode-nr
Every failure in setup_mq_sysctls() and setup_ipc_sysctls() leaves an
mqueue superblock behind with its root inode, about seven per round.
Without this patch inode-nr goes from 967 to 1678, with it it stays at
967.
repro.c:
#define _GNU_SOURCE
#include <fcntl.h>
#include <sched.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/wait.h>
#include <unistd.h>
/*
* Fail the nth slab allocation of unshare(CLONE_NEWIPC). Returns 1 once
* nth is past the last one: nothing was injected and unshare() worked.
*/
static int last(int nth)
{
int status;
if (!fork()) {
char buf[16] = "";
int fd, ret;
fd = open("/proc/thread-self/fail-nth", O_RDWR);
snprintf(buf, sizeof(buf), "%d", nth);
write(fd, buf, strlen(buf));
ret = unshare(CLONE_NEWIPC);
pread(fd, buf, sizeof(buf) - 1, 0);
_exit(!ret && atoi(buf));
}
wait(&status);
return WEXITSTATUS(status);
}
int main(int argc, char *argv[])
{
for (int i = 0; i < atoi(argv[1]); i++)
for (int nth = 1; !last(nth); nth++)
;
return 0;
}
---
ipc/namespace.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/ipc/namespace.c b/ipc/namespace.c
index 1e71353bdb4a..75aa7b469348 100644
--- a/ipc/namespace.c
+++ b/ipc/namespace.c
@@ -96,7 +96,7 @@ static struct ipc_namespace *create_ipc_ns(struct
user_namespace *user_ns,
fail_mq_sysctls:
retire_mq_sysctls(ns);
fail_mq_mount:
- mntput(ns->mq_mnt);
+ kern_unmount(ns->mq_mnt);
fail_put:
put_user_ns(ns->user_ns);
ns_common_free(ns);
--
2.53.0
