ntsync: fix a file reference leak in drivers/misc/ntsync.c
struct ntsync_obj contains a reference to struct file and that reference contributes to refcount - ntsync_alloc_obj() grabs it. Normally the object is destroyed (and reference to obj->file dropped) in ntsync_obj_release(). However, in case of ntsync_obj_get_fd() failure the object is destroyed directly by its creator. That case should also drop obj->file; plain kfree(obj) is not enough there - it ends up leaking struct file * reference. Take that logics into a helper (ntsync_free_obj()) and use it in both codepaths that destroy ntsync_obj instances. Fixes: b46271ec "ntsync: Introduce NTSYNC_IOC_CREATE_SEM" Signed-off-by:Al Viro <viro@zeniv.linux.org.uk> Reviewed-by:
Elizabeth Figura <zfigura@codeweavers.com> Link: https://lore.kernel.org/r/20250115025002.GA1977892@ZenIV Signed-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Loading
Please sign in to comment