ipc/msg.c: fix percpu_counter use after free

These percpu counters are referenced in free_ipcs->freeque, so destroy them later. Fixes: 72d1e61 ("ipc/msg: mitigate the lock contention with percpu counter") Reported-by: [email protected] Tested-by: Mark Rutland <[email protected]> Cc: Jiebin Sun <[email protected]> Signed-off-by: Andrew Morton <[email protected]>
chewitt · Oct 28, 2022 · 64b4c41 · 64b4c41
1 parent 27d676a
commit 64b4c41
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/ipc/msg.c b/ipc/msg.c
@@ -1329,11 +1329,11 @@ int msg_init_ns(struct ipc_namespace *ns)
 #ifdef CONFIG_IPC_NS
 void msg_exit_ns(struct ipc_namespace *ns)
 {
-	percpu_counter_destroy(&ns->percpu_msg_bytes);
-	percpu_counter_destroy(&ns->percpu_msg_hdrs);
 	free_ipcs(ns, &msg_ids(ns), freeque);
 	idr_destroy(&ns->ids[IPC_MSG_IDS].ipcs_idr);
 	rhashtable_destroy(&ns->ids[IPC_MSG_IDS].key_ht);
+	percpu_counter_destroy(&ns->percpu_msg_bytes);
+	percpu_counter_destroy(&ns->percpu_msg_hdrs);
 }
 #endif