diff options
| author | Ulrich Drepper <drepper@redhat.com> | 2008-05-06 20:42:38 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2008-05-08 10:46:56 -0700 |
| commit | ba719baeabbff5476eeb91c223e6921ba29e1490 (patch) | |
| tree | f3023d34b9ca087412839f6b5937478d49e567ec | |
| parent | c1236d31a1b9fc018b85e15a3e58e3601ddc90ae (diff) | |
| download | kernel_goldelico_gta04-ba719baeabbff5476eeb91c223e6921ba29e1490.zip kernel_goldelico_gta04-ba719baeabbff5476eeb91c223e6921ba29e1490.tar.gz kernel_goldelico_gta04-ba719baeabbff5476eeb91c223e6921ba29e1490.tar.bz2 | |
sys_pipe(): fix file descriptor leaks
Remember to close the files if copy_to_user() failed.
Spotted by dm.n9107@gmail.com.
Signed-off-by: Ulrich Drepper <drepper@redhat.com>
Cc: DM <dm.n9107@gmail.com>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
| -rw-r--r-- | arch/cris/kernel/sys_cris.c | 5 | ||||
| -rw-r--r-- | arch/m32r/kernel/sys_m32r.c | 5 | ||||
| -rw-r--r-- | fs/pipe.c | 6 |
3 files changed, 13 insertions, 3 deletions
diff --git a/arch/cris/kernel/sys_cris.c b/arch/cris/kernel/sys_cris.c index 8b99841..d124066 100644 --- a/arch/cris/kernel/sys_cris.c +++ b/arch/cris/kernel/sys_cris.c @@ -40,8 +40,11 @@ asmlinkage int sys_pipe(unsigned long __user * fildes) error = do_pipe(fd); unlock_kernel(); if (!error) { - if (copy_to_user(fildes, fd, 2*sizeof(int))) + if (copy_to_user(fildes, fd, 2*sizeof(int))) { + sys_close(fd[0]); + sys_close(fd[1]); error = -EFAULT; + } } return error; } diff --git a/arch/m32r/kernel/sys_m32r.c b/arch/m32r/kernel/sys_m32r.c index 6d7a80f..319c797 100644 --- a/arch/m32r/kernel/sys_m32r.c +++ b/arch/m32r/kernel/sys_m32r.c @@ -90,8 +90,11 @@ sys_pipe(unsigned long r0, unsigned long r1, unsigned long r2, error = do_pipe(fd); if (!error) { - if (copy_to_user((void __user *)r0, fd, 2*sizeof(int))) + if (copy_to_user((void __user *)r0, fd, 2*sizeof(int))) { + sys_close(fd[0]); + sys_close(fd[1]); error = -EFAULT; + } } return error; } @@ -17,6 +17,7 @@ #include <linux/highmem.h> #include <linux/pagemap.h> #include <linux/audit.h> +#include <linux/syscalls.h> #include <asm/uaccess.h> #include <asm/ioctls.h> @@ -1086,8 +1087,11 @@ asmlinkage long __weak sys_pipe(int __user *fildes) error = do_pipe(fd); if (!error) { - if (copy_to_user(fildes, fd, sizeof(fd))) + if (copy_to_user(fildes, fd, sizeof(fd))) { + sys_close(fd[0]); + sys_close(fd[1]); error = -EFAULT; + } } return error; } |