On Wed, Jan 15, 2025 at 12:20:34PM -0600, Elizabeth Figura wrote: > On Tuesday, 14 January 2025 20:50:02 CST Al Viro wrote: > > struct ntsync_obj contains a reference to struct file > > and that reference contributes to refcount - ntsync_alloc_obj() > > grabs it. Normally the object is destroyed (and reference > > to obj->file dropped) in ntsync_obj_release(). However, in > > case of ntsync_obj_get_fd() failure the object is destroyed > > directly by its creator. > > > > That case should also drop obj->file; plain kfree(obj) > > is not enough there - it ends up leaking struct file * reference. > > > > Take that logics into a helper (ntsync_free_obj()) and > > use it in both codepaths that destroy ntsync_obj instances. > > > > Fixes: b46271ec40a05 "ntsync: Introduce NTSYNC_IOC_CREATE_SEM" > > Signed-off-by: Al Viro <viro@xxxxxxxxxxxxxxxxxx> > > --- > > Reviewed-by: Elizabeth Figura <zfigura@xxxxxxxxxxxxxxx> > > > --- > > Thanks for catching this. There's a similar problem with the other newly introduced object types in the char-misc-next tree (and this patch doesn't apply cleanly there anyway). I'll send a similar patch for those, unless you have one already. I already applied this and fixed up the fuzz there, it's now running through 0-day testing... thanks, greg k-h
