Commit 12b7f6ed authored Nov 10, 2015 by Miklos Szeredi Committed by Razziell May 27, 2018

cuse: fix memory leak



The problem is that fuse_dev_alloc() acquires an extra reference to cc.fc,
and the original ref count is never dropped.

Reported-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
Fixes: cc080e9e9be1 ("fuse: introduce per-instance fuse_dev structure")
Cc: <stable@vger.kernel.org> # v4.2+
Signed-off-by: lennart <lennart.1997@gmx.de>

parent d7c18400

fs/fuse/cuse.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -551,6 +551,8 @@ static int cuse_channel_release(struct inode inode, struct file file)
		unregister_chrdev_region(cc->cdev->dev, 1);
		cdev_del(cc->cdev);
		}
		/* Base reference is now owned by "fud" */
		fuse_conn_put(&cc->fc);

		rc = fuse_dev_release(inode, file); /* puts the base reference */