releases/2.6.31.12/fix-more-leaks-in-audit_tree.c-tag_chunk.patch

   1 From b4c30aad39805902cf5b855aa8a8b22d728ad057 Mon Sep 17 00:00:00 2001
   2 From: Al Viro <viro@ZenIV.linux.org.uk>
   3 Date: Sat, 19 Dec 2009 16:03:30 +0000
   4 Subject: fix more leaks in audit_tree.c tag_chunk()
   5
   6 From: Al Viro <viro@ZenIV.linux.org.uk>
   7
   8 commit b4c30aad39805902cf5b855aa8a8b22d728ad057 upstream.
   9
  10 Several leaks in audit_tree didn't get caught by commit
  11 318b6d3d7ddbcad3d6867e630711b8a705d873d7, including the leak on normal
  12 exit in case of multiple rules refering to the same chunk.
  13
  14 Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
  15 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  16 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  17
  18 ---
  19  kernel/audit_tree.c |    9 ++++++---
  20  1 file changed, 6 insertions(+), 3 deletions(-)
  21
  22 --- a/kernel/audit_tree.c
  23 +++ b/kernel/audit_tree.c
  24 @@ -373,15 +373,17 @@ static int tag_chunk(struct inode *inode
  25         for (n = 0; n < old->count; n++) {
  26                 if (old->owners[n].owner == tree) {
  27                         spin_unlock(&hash_lock);
  28 -                       put_inotify_watch(watch);
  29 +                       put_inotify_watch(&old->watch);
  30                         return 0;
  31                 }
  32         }
  33         spin_unlock(&hash_lock);
  34
  35         chunk = alloc_chunk(old->count + 1);
  36 -       if (!chunk)
  37 +       if (!chunk) {
  38 +               put_inotify_watch(&old->watch);
  39                 return -ENOMEM;
  40 +       }
  41
  42         mutex_lock(&inode->inotify_mutex);
  43         if (inotify_clone_watch(&old->watch, &chunk->watch) < 0) {
  44 @@ -425,7 +427,8 @@ static int tag_chunk(struct inode *inode
  45         spin_unlock(&hash_lock);
  46         inotify_evict_watch(&old->watch);
  47         mutex_unlock(&inode->inotify_mutex);
  48 -       put_inotify_watch(&old->watch);
  49 +       put_inotify_watch(&old->watch); /* pair to inotify_find_watch */
  50 +       put_inotify_watch(&old->watch); /* and kill it */
  51         return 0;
  52  }
  53