Skip to content

Commit

Permalink
binary_sysctl(): fix memory leak
Browse files Browse the repository at this point in the history
binary_sysctl() calls sysctl_getname() which allocates from names_cache
slab usin __getname()

The matching function to free the name is __putname(), and not putname()
which should be used only to match getname() allocations.

This is because when auditing is enabled, putname() calls audit_putname
*instead* (not in addition) to __putname().  Then, if a syscall is in
progress, audit_putname does not release the name - instead, it expects
the name to get released when the syscall completes, but that will happen
only if audit_getname() was called previously, i.e.  if the name was
allocated with getname() rather than the naked __getname().  So,
__getname() followed by putname() ends up leaking memory.

Signed-off-by: Michel Lespinasse <[email protected]>
Acked-by: Al Viro <[email protected]>
Cc: Christoph Hellwig <[email protected]>
Cc: Eric Paris <[email protected]>
Cc: <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
  • Loading branch information
walken-google authored and torvalds committed Dec 20, 2011
1 parent 0006526 commit 3d3c8f9
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion kernel/sysctl_binary.c
Original file line number Diff line number Diff line change
Expand Up @@ -1354,7 +1354,7 @@ static ssize_t binary_sysctl(const int *name, int nlen,

fput(file);
out_putname:
putname(pathname);
__putname(pathname);
out:
return result;
}
Expand Down

0 comments on commit 3d3c8f9

Please sign in to comment.