On 4/3/24 4:09 AM, Christian Brauner wrote:
>> @@ -2215,16 +2216,25 @@ static int new_userfaultfd(int flags)
>> init_rwsem(&ctx->map_changing_lock);
>> atomic_set(&ctx->mmap_changing, 0);
>> ctx->mm = current->mm;
>> - /* prevent the mm struct to be freed */
>> - mmgrab(ctx->mm);
>> +
>> + fd = get_unused_fd_flags(O_RDONLY | (flags & UFFD_SHARED_FCNTL_FLAGS));
>> + if (fd < 0)
>> + goto err_out;
>>
>> /* Create a new inode so that the LSM can block the creation. */
>> - fd = anon_inode_create_getfd("[userfaultfd]", &userfaultfd_fops, ctx,
>> + file = anon_inode_create_getfile("[userfaultfd]", &userfaultfd_fops, ctx,
>> O_RDONLY | (flags & UFFD_SHARED_FCNTL_FLAGS), NULL);
>> - if (fd < 0) {
>> - mmdrop(ctx->mm);
>> - kmem_cache_free(userfaultfd_ctx_cachep, ctx);
>> + if (IS_ERR(file)) {
>> + fd = PTR_ERR(file);
>> + goto err_out;
>
> You're leaking the fd you allocated above.
Oops yes - thanks, fixed.
--
Jens Axboe
