Skip to content
Browse files

mqueue: fix kernel BUG caused by double free() on mq_open()

In case of aborting because we reach the maximum amount of memory which
can be allocated to message queues per user (RLIMIT_MSGQUEUE), we would
try to free the message area twice when bailing out: first by the error
handling code itself, and then later when cleaning up the inode through

Signed-off-by: André Goddard Rosa <>
Cc: Alexey Dobriyan <>
Cc: Al Viro <>
Cc: <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
  • Loading branch information...
1 parent de145b4 commit a3ed2a15719219769bb095b28009c1d654a419e8 @andre-rosa andre-rosa committed with torvalds May 11, 2010
Showing with 1 addition and 1 deletion.
  1. +1 −1 ipc/mqueue.c
2 ipc/mqueue.c
@@ -158,7 +158,7 @@ static struct inode *mqueue_get_inode(struct super_block *sb,
u->mq_bytes + mq_bytes >
task_rlimit(p, RLIMIT_MSGQUEUE)) {
- kfree(info->messages);
+ /* mqueue_delete_inode() releases info->messages */
goto out_inode;
u->mq_bytes += mq_bytes;

0 comments on commit a3ed2a1

Please sign in to comment.
Something went wrong with that request. Please try again.