]>
Commit | Line | Data |
---|---|---|
166196fc GKH |
1 | From b4c30aad39805902cf5b855aa8a8b22d728ad057 Mon Sep 17 00:00:00 2001 |
2 | From: Al Viro <viro@ZenIV.linux.org.uk> | |
3 | Date: Sat, 19 Dec 2009 16:03:30 +0000 | |
4 | Subject: fix more leaks in audit_tree.c tag_chunk() | |
5 | ||
6 | From: Al Viro <viro@ZenIV.linux.org.uk> | |
7 | ||
8 | commit b4c30aad39805902cf5b855aa8a8b22d728ad057 upstream. | |
9 | ||
10 | Several leaks in audit_tree didn't get caught by commit | |
11 | 318b6d3d7ddbcad3d6867e630711b8a705d873d7, including the leak on normal | |
12 | exit in case of multiple rules refering to the same chunk. | |
13 | ||
14 | Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> | |
15 | Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | |
16 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | |
17 | ||
18 | --- | |
19 | kernel/audit_tree.c | 9 ++++++--- | |
20 | 1 file changed, 6 insertions(+), 3 deletions(-) | |
21 | ||
22 | --- a/kernel/audit_tree.c | |
23 | +++ b/kernel/audit_tree.c | |
24 | @@ -373,15 +373,17 @@ static int tag_chunk(struct inode *inode | |
25 | for (n = 0; n < old->count; n++) { | |
26 | if (old->owners[n].owner == tree) { | |
27 | spin_unlock(&hash_lock); | |
28 | - put_inotify_watch(watch); | |
29 | + put_inotify_watch(&old->watch); | |
30 | return 0; | |
31 | } | |
32 | } | |
33 | spin_unlock(&hash_lock); | |
34 | ||
35 | chunk = alloc_chunk(old->count + 1); | |
36 | - if (!chunk) | |
37 | + if (!chunk) { | |
38 | + put_inotify_watch(&old->watch); | |
39 | return -ENOMEM; | |
40 | + } | |
41 | ||
42 | mutex_lock(&inode->inotify_mutex); | |
43 | if (inotify_clone_watch(&old->watch, &chunk->watch) < 0) { | |
44 | @@ -425,7 +427,8 @@ static int tag_chunk(struct inode *inode | |
45 | spin_unlock(&hash_lock); | |
46 | inotify_evict_watch(&old->watch); | |
47 | mutex_unlock(&inode->inotify_mutex); | |
48 | - put_inotify_watch(&old->watch); | |
49 | + put_inotify_watch(&old->watch); /* pair to inotify_find_watch */ | |
50 | + put_inotify_watch(&old->watch); /* and kill it */ | |
51 | return 0; | |
52 | } | |
53 |