The patch titled sys_pipe(): fix fd leak if pipe() is called with an invalid address has been added to the -mm tree. Its filename is sys_pipe-fix-fd-leak-if-pipe-is-called-with-an-invalid-address.patch Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/SubmitChecklist when testing your code *** See http://userweb.kernel.org/~akpm/stuff/added-to-mm.txt to find out what to do about this The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/ ------------------------------------------------------ Subject: sys_pipe(): fix fd leak if pipe() is called with an invalid address From: Changli Gao <xiaosuo@xxxxxxxxx> fd leak if pipe() is called with an invalid address. Though -EFAULT is returned, the file descriptors opened by pipe() call are left open. Signed-off-by: Changli Gao <xiaosuo@xxxxxxxxx> Cc: Ingo Molnar <mingo@xxxxxxx> Cc: Christian Zankel <chris@xxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- arch/x86/ia32/sys_ia32.c | 5 ++++- arch/xtensa/kernel/syscall.c | 5 ++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff -puN arch/x86/ia32/sys_ia32.c~sys_pipe-fix-fd-leak-if-pipe-is-called-with-an-invalid-address arch/x86/ia32/sys_ia32.c --- a/arch/x86/ia32/sys_ia32.c~sys_pipe-fix-fd-leak-if-pipe-is-called-with-an-invalid-address +++ a/arch/x86/ia32/sys_ia32.c @@ -197,8 +197,11 @@ asmlinkage long sys32_pipe(int __user *f retval = do_pipe_flags(fds, 0); if (retval) goto out; - if (copy_to_user(fd, fds, sizeof(fds))) + if (copy_to_user(fd, fds, sizeof(fds))) { + sys_close(fd[0]); + sys_close(fd[1]); retval = -EFAULT; + } out: return retval; } diff -puN arch/xtensa/kernel/syscall.c~sys_pipe-fix-fd-leak-if-pipe-is-called-with-an-invalid-address arch/xtensa/kernel/syscall.c --- a/arch/xtensa/kernel/syscall.c~sys_pipe-fix-fd-leak-if-pipe-is-called-with-an-invalid-address +++ a/arch/xtensa/kernel/syscall.c @@ -51,8 +51,11 @@ asmlinkage long xtensa_pipe(int __user * error = do_pipe_flags(fd, 0); if (!error) { - if (copy_to_user(userfds, fd, 2 * sizeof(int))) + if (copy_to_user(userfds, fd, 2 * sizeof(int))) { + sys_close(fd[0]); + sys_close(fd[1]); error = -EFAULT; + } } return error; } _ Patches currently in -mm which might be from xiaosuo@xxxxxxxxx are sys_pipe-fix-fd-leak-if-pipe-is-called-with-an-invalid-address.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html