Commit 318b6d3d authored by Eric Paris's avatar Eric Paris Committed by Al Viro
Browse files

audit: incorrect ref counting in audit tree tag_chunk



tag_chunk has bad exit paths in which the inotify ref counting is wrong.
At the top of the function we found &old_watch using  inotify_find_watch().
inotify_find_watch takes a reference to the watch.  This is never dropped
on an error path.
Signed-off-by: default avatarEric Paris <eparis@redhat.com>
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent 6d208da8
...@@ -385,6 +385,7 @@ static int tag_chunk(struct inode *inode, struct audit_tree *tree) ...@@ -385,6 +385,7 @@ static int tag_chunk(struct inode *inode, struct audit_tree *tree)
mutex_lock(&inode->inotify_mutex); mutex_lock(&inode->inotify_mutex);
if (inotify_clone_watch(&old->watch, &chunk->watch) < 0) { if (inotify_clone_watch(&old->watch, &chunk->watch) < 0) {
mutex_unlock(&inode->inotify_mutex); mutex_unlock(&inode->inotify_mutex);
put_inotify_watch(&old->watch);
free_chunk(chunk); free_chunk(chunk);
return -ENOSPC; return -ENOSPC;
} }
...@@ -394,6 +395,7 @@ static int tag_chunk(struct inode *inode, struct audit_tree *tree) ...@@ -394,6 +395,7 @@ static int tag_chunk(struct inode *inode, struct audit_tree *tree)
chunk->dead = 1; chunk->dead = 1;
inotify_evict_watch(&chunk->watch); inotify_evict_watch(&chunk->watch);
mutex_unlock(&inode->inotify_mutex); mutex_unlock(&inode->inotify_mutex);
put_inotify_watch(&old->watch);
put_inotify_watch(&chunk->watch); put_inotify_watch(&chunk->watch);
return 0; return 0;
} }
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment