Commit 0e7d523b authored by Al Viro's avatar Al Viro Committed by Greg Kroah-Hartman
Browse files

ntsync: fix a file reference leak in drivers/misc/ntsync.c



	struct ntsync_obj contains a reference to struct file
and that reference contributes to refcount - ntsync_alloc_obj()
grabs it.  Normally the object is destroyed (and reference
to obj->file dropped) in ntsync_obj_release().  However, in
case of ntsync_obj_get_fd() failure the object is destroyed
directly by its creator.

	That case should also drop obj->file; plain kfree(obj)
is not enough there - it ends up leaking struct file * reference.

	Take that logics into a helper (ntsync_free_obj()) and
use it in both codepaths that destroy ntsync_obj instances.

Fixes: b46271ec "ntsync: Introduce NTSYNC_IOC_CREATE_SEM"
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
Reviewed-by: default avatarElizabeth Figura <zfigura@codeweavers.com>
Link: https://lore.kernel.org/r/20250115025002.GA1977892@ZenIV


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 2217573f
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment