Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2c5816b4 authored by Miklos Szeredi's avatar Miklos Szeredi
Browse files

cuse: fix memory leak 



The problem is that fuse_dev_alloc() acquires an extra reference to cc.fc,
and the original ref count is never dropped.

Reported-by: default avatarColin Ian King <colin.king@canonical.com>
Signed-off-by: default avatarMiklos Szeredi <miklos@szeredi.hu>
Fixes: cc080e9e ("fuse: introduce per-instance fuse_dev structure")
Cc: <stable@vger.kernel.org> # v4.2+
parent 6a13feb9

fs/fuse/cuse.c

+2 −0
Original line number Original line Diff line number Diff line
@@ -549,6 +549,8 @@ static int cuse_channel_release(struct inode *inode, struct file *file) 
		unregister_chrdev_region(cc->cdev->dev, 1);

		unregister_chrdev_region(cc->cdev->dev, 1);

		cdev_del(cc->cdev);

		cdev_del(cc->cdev);

	}

	}

	/* Base reference is now owned by "fud" */

	fuse_conn_put(&cc->fc);





	rc = fuse_dev_release(inode, file);	/* puts the base reference */

	rc = fuse_dev_release(inode, file);	/* puts the base reference */