mirror of
https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git
synced 2024-09-21 20:04:01 +00:00
ecryptfs: Fix refcnt leak on ecryptfs_follow_link() error path
If ->follow_link handler return the error, it should decrement nd->path refcnt. But, ecryptfs_follow_link() doesn't decrement. This patch fix it by using usual nd_set_link() style error handling, instead of playing with nd->path. Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
This commit is contained in:
parent
6d125529c6
commit
806892e9e1
|
@ -715,31 +715,31 @@ static void *ecryptfs_follow_link(struct dentry *dentry, struct nameidata *nd)
|
||||||
/* Released in ecryptfs_put_link(); only release here on error */
|
/* Released in ecryptfs_put_link(); only release here on error */
|
||||||
buf = kmalloc(len, GFP_KERNEL);
|
buf = kmalloc(len, GFP_KERNEL);
|
||||||
if (!buf) {
|
if (!buf) {
|
||||||
rc = -ENOMEM;
|
buf = ERR_PTR(-ENOMEM);
|
||||||
goto out;
|
goto out;
|
||||||
}
|
}
|
||||||
old_fs = get_fs();
|
old_fs = get_fs();
|
||||||
set_fs(get_ds());
|
set_fs(get_ds());
|
||||||
rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
|
rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
|
||||||
set_fs(old_fs);
|
set_fs(old_fs);
|
||||||
if (rc < 0)
|
if (rc < 0) {
|
||||||
goto out_free;
|
kfree(buf);
|
||||||
else
|
buf = ERR_PTR(rc);
|
||||||
|
} else
|
||||||
buf[rc] = '\0';
|
buf[rc] = '\0';
|
||||||
rc = 0;
|
|
||||||
nd_set_link(nd, buf);
|
|
||||||
goto out;
|
|
||||||
out_free:
|
|
||||||
kfree(buf);
|
|
||||||
out:
|
out:
|
||||||
return ERR_PTR(rc);
|
nd_set_link(nd, buf);
|
||||||
|
return NULL;
|
||||||
}
|
}
|
||||||
|
|
||||||
static void
|
static void
|
||||||
ecryptfs_put_link(struct dentry *dentry, struct nameidata *nd, void *ptr)
|
ecryptfs_put_link(struct dentry *dentry, struct nameidata *nd, void *ptr)
|
||||||
{
|
{
|
||||||
/* Free the char* */
|
char *buf = nd_get_link(nd);
|
||||||
kfree(nd_get_link(nd));
|
if (!IS_ERR(buf)) {
|
||||||
|
/* Free the char* */
|
||||||
|
kfree(buf);
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
|
|
Loading…
Reference in a new issue