Skip to contentSkip to conversation

swapfile: fix name leak in swapoff

PATCH In review Xiaotian Feng 3 participants 3 messages Nov 1, 2012 – Nov 14, 2012

Subsystems (2)
Memory management MM swap
lore
Share & tools
lore

Xiaotian Feng

author
#0 lore raw

PATCH 1/1 swapfile: fix name leak in swapoff

there's a name leak introduced by commit 91a27b2, add the missing putname.

Signed-off-by Xiaotian Feng <[email protected]>
Cc Jeff Layton <[email protected]>
Cc Al Viro <[email protected]>
---
 mm/swapfile.c |    2 ++
 1 file changed, 2 insertions(+)
mm/swapfile.c +2 -0
index 71cd288..459fe30 100644
@@ -1608,6 +1608,8 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)
 out_dput:
 	filp_close(victim, NULL);
 out:
+	if (pathname && !IS_ERR(pathname))
+		putname(pathname);
 	return err;
 }
Signature · 1 line
1.7.9.5
Reviewed-by on v1 1/1
#1 lore raw
Quoted 15 lines · On Thu, 1 Nov 2012 17:36:55 +0800 Xiaotian Feng <[email protected]> wrote:

there's a name leak introduced by commit 91a27b2, add the missing putname.

Signed-off-by Xiaotian Feng <[email protected]>
Cc Jeff Layton <[email protected]>
Cc Al Viro <[email protected]>
---
 mm/swapfile.c |    2 ++
 1 file changed, 2 insertions(+)
mm/swapfile.c +0 -0
index 71cd288..459fe30 100644

mm/swapfile.c SYSCALL_DEFINE1(swapoff, const char __user *, specialfile) · line 1615

Quoted 8 lines
mm/swapfile.c +2 -0
@@ -1608,6 +1608,8 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)
 out_dput:
 	filp_close(victim, NULL);
 out:
+	if (pathname && !IS_ERR(pathname))
+		putname(pathname);
 	return err;
 }

Nice catch.

Reviewed-by Jeff Layton <[email protected]>
maintainer
#2 lore raw
In reply to Xiaotian Feng
Quoted 15 lines · On Thu, 1 Nov 2012 17:36:55 +0800 Xiaotian Feng <[email protected]> wrote:

there's a name leak introduced by commit 91a27b2, add the missing putname.

Signed-off-by Xiaotian Feng <[email protected]>
Cc Jeff Layton <[email protected]>
Cc Al Viro <[email protected]>
---
 mm/swapfile.c |    2 ++
 1 file changed, 2 insertions(+)
mm/swapfile.c +0 -0
index 71cd288..459fe30 100644

mm/swapfile.c SYSCALL_DEFINE1(swapoff, const char __user *, specialfile) · line 1614

Quoted 7 lines
mm/swapfile.c +2 -0
@@ -1608,6 +1608,8 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)
 out_dput:
 	filp_close(victim, NULL);
 out:
+	if (pathname && !IS_ERR(pathname))
+		putname(pathname);
 	return err;
 }

This way is simpler:

mm/swapfile.c renamed from mm/swapfile.c~swapfile-fix-name-leak-in-swapoff-fix +2 -4
@@ -1507,9 +1507,8 @@ SYSCALL_DEFINE1(swapoff, const char __us
 	BUG_ON(!current->mm);
 
 	pathname = getname(specialfile);
-	err = PTR_ERR(pathname);
 	if (IS_ERR(pathname))
-		goto out;
+		return PTR_ERR(pathname);
 
 	victim = file_open_name(pathname, O_RDWR|O_LARGEFILE, 0);
 	err = PTR_ERR(victim);

@@ -1615,8 +1614,7 @@ SYSCALL_DEFINE1(swapoff, const char __us
 out_dput:
 	filp_close(victim, NULL);
 out:
-	if (pathname && !IS_ERR(pathname))
-		putname(pathname);
+	putname(pathname);
 	return err;
 }

_

It would be even simpler to do the putname() immediately after file_open_name(), but it is nice to keep `pathname' live for the whole function in case it gets used by later code.