diff options
| author | Vincent Minet <v.minet@criteo.com> | 2020-05-08 00:14:22 +0200 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2020-05-09 04:06:55 +0200 |
| commit | db803036ada7d61d096783726f9771b3fc540370 (patch) | |
| tree | 538a193dd95f6afe20309e7af2182ec6fd7d6845 | |
| parent | Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf (diff) | |
| download | linux-db803036ada7d61d096783726f9771b3fc540370.tar.xz linux-db803036ada7d61d096783726f9771b3fc540370.zip | |
umh: fix memory leak on execve failure
If a UMH process created by fork_usermode_blob() fails to execute,
a pair of struct file allocated by umh_pipe_setup() will leak.
Under normal conditions, the caller (like bpfilter) needs to manage the
lifetime of the UMH and its two pipes. But when fork_usermode_blob()
fails, the caller doesn't really have a way to know what needs to be
done. It seems better to do the cleanup ourselves in this case.
Fixes: 449325b52b7a ("umh: introduce fork_usermode_blob() helper")
Signed-off-by: Vincent Minet <v.minet@criteo.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
| -rw-r--r-- | kernel/umh.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/kernel/umh.c b/kernel/umh.c index 7f255b5a8845..20d51e0957e0 100644 --- a/kernel/umh.c +++ b/kernel/umh.c @@ -475,6 +475,12 @@ static void umh_clean_and_save_pid(struct subprocess_info *info) { struct umh_info *umh_info = info->data; + /* cleanup if umh_pipe_setup() was successful but exec failed */ + if (info->pid && info->retval) { + fput(umh_info->pipe_to_umh); + fput(umh_info->pipe_from_umh); + } + argv_free(info->argv); umh_info->pid = info->pid; } |