]> git.ipfire.org Git - thirdparty/linux.git/commit
ntsync: fix a file reference leak in drivers/misc/ntsync.c
authorAl Viro <viro@zeniv.linux.org.uk>
Wed, 15 Jan 2025 02:50:02 +0000 (02:50 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 16 Jan 2025 13:03:10 +0000 (14:03 +0100)
commit0e7d523b5f7a23b1dc6ceceb04e31a60e9e3321d
treef5d48ba2fef5a29afbcfca11c1b951a49d4c1fd9
parent2217573f4c8797eb5ed764a728f986aa80bd403c
ntsync: fix a file reference leak in drivers/misc/ntsync.c

struct ntsync_obj contains a reference to struct file
and that reference contributes to refcount - ntsync_alloc_obj()
grabs it.  Normally the object is destroyed (and reference
to obj->file dropped) in ntsync_obj_release().  However, in
case of ntsync_obj_get_fd() failure the object is destroyed
directly by its creator.

That case should also drop obj->file; plain kfree(obj)
is not enough there - it ends up leaking struct file * reference.

Take that logics into a helper (ntsync_free_obj()) and
use it in both codepaths that destroy ntsync_obj instances.

Fixes: b46271ec40a05 "ntsync: Introduce NTSYNC_IOC_CREATE_SEM"
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Reviewed-by: Elizabeth Figura <zfigura@codeweavers.com>
Link: https://lore.kernel.org/r/20250115025002.GA1977892@ZenIV
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/misc/ntsync.c