summaryrefslogtreecommitdiff
path: root/kernel
diff options
context:
space:
mode:
authorMichel Lespinasse <walken@google.com>2011-12-19 17:12:06 -0800
committerRohan Somvanshi <rsomvanshi@nvidia.com>2012-01-11 09:29:06 -0800
commitc3b50f5523309f711d0f10c1ba518d5a0aafdd65 (patch)
tree04d9a9bbd746097b345c50d674ecb64de86a38bb /kernel
parent2976f8a85459c5a088171b9792292c2eab2d9147 (diff)
binary_sysctl(): fix memory leak
commit 3d3c8f93a237b64580c5c5e138edeb1377e98230 upstream. binary_sysctl() calls sysctl_getname() which allocates from names_cache slab usin __getname() The matching function to free the name is __putname(), and not putname() which should be used only to match getname() allocations. This is because when auditing is enabled, putname() calls audit_putname *instead* (not in addition) to __putname(). Then, if a syscall is in progress, audit_putname does not release the name - instead, it expects the name to get released when the syscall completes, but that will happen only if audit_getname() was called previously, i.e. if the name was allocated with getname() rather than the naked __getname(). So, __getname() followed by putname() ends up leaking memory. Signed-off-by: Michel Lespinasse <walken@google.com> Acked-by: Al Viro <viro@zeniv.linux.org.uk> Cc: Christoph Hellwig <hch@infradead.org> Cc: Eric Paris <eparis@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> Change-Id: Ia6c066b0703eeafc61eafdd5addf157ee671bd68 Reviewed-on: http://git-master/r/74175 Reviewed-by: Varun Wadekar <vwadekar@nvidia.com> Tested-by: Varun Wadekar <vwadekar@nvidia.com>
Diffstat (limited to 'kernel')
-rw-r--r--kernel/sysctl_binary.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/kernel/sysctl_binary.c b/kernel/sysctl_binary.c
index e8bffbe2ba4b..2ce1b3086726 100644
--- a/kernel/sysctl_binary.c
+++ b/kernel/sysctl_binary.c
@@ -1354,7 +1354,7 @@ static ssize_t binary_sysctl(const int *name, int nlen,
fput(file);
out_putname:
- putname(pathname);
+ __putname(pathname);
out:
return result;
}