umh: fix memory leak on execve failure
authorVincent Minet <v.minet@criteo.com>
Thu, 7 May 2020 22:14:22 +0000 (00:14 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 20 May 2020 06:20:13 +0000 (08:20 +0200)
[ Upstream commit db803036ada7d61d096783726f9771b3fc540370 ]

If a UMH process created by fork_usermode_blob() fails to execute,
a pair of struct file allocated by umh_pipe_setup() will leak.

Under normal conditions, the caller (like bpfilter) needs to manage the
lifetime of the UMH and its two pipes. But when fork_usermode_blob()
fails, the caller doesn't really have a way to know what needs to be
done. It seems better to do the cleanup ourselves in this case.

Fixes: 449325b52b7a ("umh: introduce fork_usermode_blob() helper")
Signed-off-by: Vincent Minet <v.minet@criteo.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
kernel/umh.c

index 11bf5ee..3474d6a 100644 (file)
@@ -475,6 +475,12 @@ static void umh_clean_and_save_pid(struct subprocess_info *info)
 {
        struct umh_info *umh_info = info->data;
 
+       /* cleanup if umh_pipe_setup() was successful but exec failed */
+       if (info->pid && info->retval) {
+               fput(umh_info->pipe_to_umh);
+               fput(umh_info->pipe_from_umh);
+       }
+
        argv_free(info->argv);
        umh_info->pid = info->pid;
 }