Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 318b6d3d authored by Eric Paris's avatar Eric Paris Committed by Al Viro
Browse files

audit: incorrect ref counting in audit tree tag_chunk 



tag_chunk has bad exit paths in which the inotify ref counting is wrong.
At the top of the function we found &old_watch using  inotify_find_watch().
inotify_find_watch takes a reference to the watch.  This is never dropped
on an error path.

Signed-off-by: default avatarEric Paris <eparis@redhat.com>
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent 6d208da8

kernel/audit_tree.c

+2 −0
Original line number Original line Diff line number Diff line
@@ -385,6 +385,7 @@ static int tag_chunk(struct inode *inode, struct audit_tree *tree) 
	mutex_lock(&inode->inotify_mutex);

	mutex_lock(&inode->inotify_mutex);

	if (inotify_clone_watch(&old->watch, &chunk->watch) < 0) {

	if (inotify_clone_watch(&old->watch, &chunk->watch) < 0) {

		mutex_unlock(&inode->inotify_mutex);

		mutex_unlock(&inode->inotify_mutex);

		put_inotify_watch(&old->watch);

		free_chunk(chunk);

		free_chunk(chunk);

		return -ENOSPC;

		return -ENOSPC;

	}

	}
@@ -394,6 +395,7 @@ static int tag_chunk(struct inode *inode, struct audit_tree *tree) 
		chunk->dead = 1;

		chunk->dead = 1;

		inotify_evict_watch(&chunk->watch);

		inotify_evict_watch(&chunk->watch);

		mutex_unlock(&inode->inotify_mutex);

		mutex_unlock(&inode->inotify_mutex);

		put_inotify_watch(&old->watch);

		put_inotify_watch(&chunk->watch);

		put_inotify_watch(&chunk->watch);

		return 0;

		return 0;

	}

	}