| From foo@baz Sat 16 May 2020 02:04:40 PM CEST |
| From: Vincent Minet <v.minet@criteo.com> |
| Date: Fri, 8 May 2020 00:14:22 +0200 |
| Subject: umh: fix memory leak on execve failure |
| |
| From: Vincent Minet <v.minet@criteo.com> |
| |
| [ Upstream commit db803036ada7d61d096783726f9771b3fc540370 ] |
| |
| If a UMH process created by fork_usermode_blob() fails to execute, |
| a pair of struct file allocated by umh_pipe_setup() will leak. |
| |
| Under normal conditions, the caller (like bpfilter) needs to manage the |
| lifetime of the UMH and its two pipes. But when fork_usermode_blob() |
| fails, the caller doesn't really have a way to know what needs to be |
| done. It seems better to do the cleanup ourselves in this case. |
| |
| Fixes: 449325b52b7a ("umh: introduce fork_usermode_blob() helper") |
| Signed-off-by: Vincent Minet <v.minet@criteo.com> |
| Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| kernel/umh.c | 6 ++++++ |
| 1 file changed, 6 insertions(+) |
| |
| --- a/kernel/umh.c |
| +++ b/kernel/umh.c |
| @@ -475,6 +475,12 @@ static void umh_clean_and_save_pid(struc |
| { |
| struct umh_info *umh_info = info->data; |
| |
| + /* cleanup if umh_pipe_setup() was successful but exec failed */ |
| + if (info->pid && info->retval) { |
| + fput(umh_info->pipe_to_umh); |
| + fput(umh_info->pipe_from_umh); |
| + } |
| + |
| argv_free(info->argv); |
| umh_info->pid = info->pid; |
| } |
