[patch 05/47] double-free of inode on alloc_file() failure exit in create_write_pipe()

Greg KH
2008-06-14T00:13:49Z

[-- Attachment #1: double-free-of-inode-on-alloc_file-failure-exit-in-create_write_pipe.patch --]
[-- Type: text/plain, Size: 734 bytes --]

-stable review patch. If anyone has any objections, please let us know.

------------------
From: Al Viro <viro@zeniv.linux.org.uk>

upstream commit: ed1524371716466e9c762808b02601d0d0276a92

Duh... Fortunately, the bug is quite recent (post-2.6.25) and, embarrassingly,
mine ;-/

http://bugzilla.kernel.org/show_bug.cgi?id=10878

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
fs/pipe.c | 3 +++
1 file changed, 3 insertions(+)

--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -988,7 +988,10 @@ struct file *create_write_pipe(void)
return f;

err_dentry:
+ free_pipe_info(inode);
dput(dentry);
+ return ERR_PTR(err);
+
err_inode:
free_pipe_info(inode);
iput(inode);

--