From: Jens Axboe <axboe@kernel.dk>
To: Eric Biggers <ebiggers@kernel.org>,
Alexander Viro <viro@zeniv.linux.org.uk>,
linux-block@vger.kernel.org, linux-fsdevel@vger.kernel.org
Cc: davem@davemloft.net, linux-kernel@vger.kernel.org,
netdev@vger.kernel.org, syzkaller-bugs@googlegroups.com,
syzbot <syzbot+111cb28d9f583693aefa@syzkaller.appspotmail.com>
Subject: Re: [PATCH] io_uring: fix memory leak of UNIX domain socket inode
Date: Thu, 13 Jun 2019 02:40:13 -0600 [thread overview]
Message-ID: <c8afa475-8ed9-e8ee-c66a-270bea7efad5@kernel.dk> (raw)
In-Reply-To: <20190612215843.91294-1-ebiggers@kernel.org>
On 6/12/19 3:58 PM, Eric Biggers wrote:
> From: Eric Biggers <ebiggers@google.com>
>
> Opening and closing an io_uring instance leaks a UNIX domain socket
> inode. This is because the ->file of the io_uring instance's internal
> UNIX domain socket is set to point to the io_uring file, but then
> sock_release() sees the non-NULL ->file and assumes the inode reference
> is held by the file so doesn't call iput(). That's not the case here,
> since the reference is still meant to be held by the socket; the actual
> inode of the io_uring file is different.
>
> Fix this leak by NULL-ing out ->file before releasing the socket.
Thanks, applied.
--
Jens Axboe
prev parent reply other threads:[~2019-06-13 16:14 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <0000000000005bc340058983fe8e@google.com>
2019-06-12 21:58 ` [PATCH] io_uring: fix memory leak of UNIX domain socket inode Eric Biggers
2019-06-13 8:40 ` Jens Axboe [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=c8afa475-8ed9-e8ee-c66a-270bea7efad5@kernel.dk \
--to=axboe@kernel.dk \
--cc=davem@davemloft.net \
--cc=ebiggers@kernel.org \
--cc=linux-block@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=syzbot+111cb28d9f583693aefa@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).