ipc/mqueue: release notification resources during inode eviction

mqueue_flush_file() removes an mq_notify() registration only when the
closing task belongs to the thread group stored in notify_owner.

A task in a separate thread group created with CLONE_FILES can register
SIGEV_THREAD notification and exit without closing the shared file table. 
If another thread group then unlinks and last-closes the queue, ->flush()
skips the registration and inode eviction loses the only pointers to its
resources.

The orphaned registration permanently retains the notification skb, its
netlink socket, a pid reference and a user namespace reference.  An
unprivileged process can repeat the sequence with new queues and sockets.

No inode users remain during eviction.  Remove any stale registration
there after dropping info->lock, since netlink_sendskb() may release the
final socket reference.

This bug creates an unkillable kernel resource leak by failing to free
netlink socket, PID, and user namespace references when a POSIX message
queue is evicted.  An unprivileged process can exploit this leak
repeatedly to cause kernel memory exhaustion and lead to a DoS.

Link: https://lore.kernel.org/20260824042359.925145-1-4ncienth@gmail.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Assisted-by: LLM
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Jan Kara <jack@suse.cz>
Cc: Manfred Spraul <manfred@colorfullife.com>
Cc: NeilBrown <neil@brown.name>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

0 files changed, 0 insertions, 0 deletions