aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorEric Biggers <[email protected]>2018-02-06 15:40:24 -0800
committerLinus Torvalds <[email protected]>2018-02-06 18:32:46 -0800
commita1be1f3931bfe0a42b46fef77a04593c2b136e7f (patch)
treebaff9a1d4276404cd0ce63aff26846d328f4f8c1
parent28f3a488ed83ac4a01406490941a6486806d1333 (diff)
kernel/relay.c: revert "kernel/relay.c: fix potential memory leak"
This reverts commit ba62bafe942b ("kernel/relay.c: fix potential memory leak"). This commit introduced a double free bug, because 'chan' is already freed by the line: kref_put(&chan->kref, relay_destroy_channel); This bug was found by syzkaller, using the BLKTRACESETUP ioctl. Link: http://lkml.kernel.org/r/[email protected] Fixes: ba62bafe942b ("kernel/relay.c: fix potential memory leak") Signed-off-by: Eric Biggers <[email protected]> Reported-by: syzbot <[email protected]> Reviewed-by: Andrew Morton <[email protected]> Cc: Zhouyi Zhou <[email protected]> Cc: Jens Axboe <[email protected]> Cc: <[email protected]> [4.7+] Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
-rw-r--r--kernel/relay.c1
1 files changed, 0 insertions, 1 deletions
diff --git a/kernel/relay.c b/kernel/relay.c
index 41280033a4c5..f7f40a6e6352 100644
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -611,7 +611,6 @@ free_bufs:
kref_put(&chan->kref, relay_destroy_channel);
mutex_unlock(&relay_channels_mutex);
- kfree(chan);
return NULL;
}
EXPORT_SYMBOL_GPL(relay_open);