Re: [PATCH] fix a file reference leak in drivers/misc/ntsync.c

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

On Wed, Jan 15, 2025 at 12:20:34PM -0600, Elizabeth Figura wrote:
> On Tuesday, 14 January 2025 20:50:02 CST Al Viro wrote:
> > 	struct ntsync_obj contains a reference to struct file
> > and that reference contributes to refcount - ntsync_alloc_obj()
> > grabs it.  Normally the object is destroyed (and reference
> > to obj->file dropped) in ntsync_obj_release().  However, in
> > case of ntsync_obj_get_fd() failure the object is destroyed
> > directly by its creator.
> > 
> > 	That case should also drop obj->file; plain kfree(obj)
> > is not enough there - it ends up leaking struct file * reference.
> > 
> > 	Take that logics into a helper (ntsync_free_obj()) and
> > use it in both codepaths that destroy ntsync_obj instances.
> > 
> > Fixes: b46271ec40a05 "ntsync: Introduce NTSYNC_IOC_CREATE_SEM"
> > Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
> > ---
> 
> Reviewed-by: Elizabeth Figura <zfigura@codeweavers.com>
> 
> 
> ---
> 
> Thanks for catching this. There's a similar problem with the other newly introduced object types in the char-misc-next tree (and this patch doesn't apply cleanly there anyway). I'll send a similar patch for those, unless you have one already.

I already applied this and fixed up the fuzz there, it's now running
through 0-day testing...

thanks,

greg k-h