Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ba719bae authored by Ulrich Drepper's avatar Ulrich Drepper Committed by Linus Torvalds
Browse files

sys_pipe(): fix file descriptor leaks 



Remember to close the files if copy_to_user() failed.

Spotted by dm.n9107@gmail.com.

Signed-off-by: default avatarUlrich Drepper <drepper@redhat.com>
Cc: DM <dm.n9107@gmail.com>
Cc: <stable@kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent c1236d31

arch/cris/kernel/sys_cris.c

+4 −1
Original line number Diff line number Diff line
@@ -40,9 +40,12 @@ asmlinkage int sys_pipe(unsigned long __user * fildes) 
        error = do_pipe(fd);

        unlock_kernel();

        if (!error) {

                if (copy_to_user(fildes, fd, 2*sizeof(int)))

                if (copy_to_user(fildes, fd, 2*sizeof(int))) {

			sys_close(fd[0]);

			sys_close(fd[1]);

                        error = -EFAULT;

		}

        }

        return error;

}

arch/m32r/kernel/sys_m32r.c

+4 −1
Original line number Diff line number Diff line
@@ -90,9 +90,12 @@ sys_pipe(unsigned long r0, unsigned long r1, unsigned long r2, 


	error = do_pipe(fd);

	if (!error) {

		if (copy_to_user((void __user *)r0, fd, 2*sizeof(int)))

		if (copy_to_user((void __user *)r0, fd, 2*sizeof(int))) {

			sys_close(fd[0]);

			sys_close(fd[1]);

			error = -EFAULT;

		}

	}

	return error;

}

fs/pipe.c

+5 −1
Original line number Diff line number Diff line
@@ -17,6 +17,7 @@ 
#include <linux/highmem.h>

#include <linux/pagemap.h>

#include <linux/audit.h>

#include <linux/syscalls.h>



#include <asm/uaccess.h>

#include <asm/ioctls.h>
@@ -1086,9 +1087,12 @@ asmlinkage long __weak sys_pipe(int __user *fildes) 


	error = do_pipe(fd);

	if (!error) {

		if (copy_to_user(fildes, fd, sizeof(fd)))

		if (copy_to_user(fildes, fd, sizeof(fd))) {

			sys_close(fd[0]);

			sys_close(fd[1]);

			error = -EFAULT;

		}

	}

	return error;

}