From mboxrd@z Thu Jan 1 00:00:00 1970 From: akpm@linux-foundation.org Subject: [patch for 2.6.29? 1/3] pipe_rdwr_fasync: fix the error handling to prevent the leak/crash Date: Wed, 04 Mar 2009 12:12:30 -0800 Message-ID: <200903042012.n24KCUlA030022@imap1.linux-foundation.org> Cc: linux-fsdevel@vger.kernel.org, akpm@linux-foundation.org, oleg@redhat.com, andi@firstfloor.org, corbet@lwn.net, stable@kernel.org, viro@zeniv.linux.org.uk To: viro@zeniv.linux.org.uk Return-path: Received: from smtp1.linux-foundation.org ([140.211.169.13]:43840 "EHLO smtp1.linux-foundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754205AbZCDUOY (ORCPT ); Wed, 4 Mar 2009 15:14:24 -0500 Sender: linux-fsdevel-owner@vger.kernel.org List-ID: From: Oleg Nesterov If the second fasync_helper() fails, pipe_rdwr_fasync() returns the error but leaves the file on ->fasync_readers. This was always wrong, but since 233e70f4228e78eb2f80dc6650f65d3ae3dbf17c "saner FASYNC handling on file close" we have the new problem. Because in this case setfl() doesn't set FASYNC bit, __fput() will not do ->fasync(0), and we leak fasync_struct with ->fa_file pointing to the freed file. Signed-off-by: Oleg Nesterov Cc: Al Viro Cc: Andi Kleen Cc: Jonathan Corbet Cc: [2.6.28.x] Signed-off-by: Andrew Morton --- fs/pipe.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff -puN fs/pipe.c~pipe_rdwr_fasync-fix-the-error-handling-to-prevent-the-leak-crash fs/pipe.c --- a/fs/pipe.c~pipe_rdwr_fasync-fix-the-error-handling-to-prevent-the-leak-crash +++ a/fs/pipe.c @@ -693,11 +693,12 @@ pipe_rdwr_fasync(int fd, struct file *fi int retval; mutex_lock(&inode->i_mutex); - retval = fasync_helper(fd, filp, on, &pipe->fasync_readers); - if (retval >= 0) + if (retval >= 0) { retval = fasync_helper(fd, filp, on, &pipe->fasync_writers); - + if (retval < 0) /* this can happen only if on == T */ + fasync_helper(-1, filp, 0, &pipe->fasync_readers); + } mutex_unlock(&inode->i_mutex); return retval; } _