On Tuesday, 14 January 2025 20:50:02 CST Al Viro wrote: > struct ntsync_obj contains a reference to struct file > and that reference contributes to refcount - ntsync_alloc_obj() > grabs it. Normally the object is destroyed (and reference > to obj->file dropped) in ntsync_obj_release(). However, in > case of ntsync_obj_get_fd() failure the object is destroyed > directly by its creator. > > That case should also drop obj->file; plain kfree(obj) > is not enough there - it ends up leaking struct file * reference. > > Take that logics into a helper (ntsync_free_obj()) and > use it in both codepaths that destroy ntsync_obj instances. > > Fixes: b46271ec40a05 "ntsync: Introduce NTSYNC_IOC_CREATE_SEM" > Signed-off-by: Al Viro <viro@xxxxxxxxxxxxxxxxxx> > --- Reviewed-by: Elizabeth Figura <zfigura@xxxxxxxxxxxxxxx> --- Thanks for catching this. There's a similar problem with the other newly introduced object types in the char-misc-next tree (and this patch doesn't apply cleanly there anyway). I'll send a similar patch for those, unless you have one already.
