fs/binfmt_elf.c: fix a wrong free

Fix a wrong free in fs/binfmt_elf.c::elf_core_dump().

Signed-off-by WANG Cong <[email protected]>

Cc Alexander Viro <[email protected]>

Cc Eric Youngdale <[email protected]>

---
 fs/binfmt_elf.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

fs/binfmt_elf.c +0 -0

index b25707f..43254e3 100644

Quoted 20 lines · WANG Cong

Fix a wrong free in fs/binfmt_elf.c::elf_core_dump().

Signed-off-by WANG Cong <[email protected]>

Cc Alexander Viro <[email protected]>

Cc Eric Youngdale <[email protected]>

---
 fs/binfmt_elf.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

fs/binfmt_elf.c +1 -0

index b25707f..43254e3 100644
@@ -2032,10 +2032,10 @@ static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file, un
 
 end_coredump:
 	set_fs(fs);
+	free_note_info(&info);
 

fs/binfmt_elf.c static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file, un · line 2040

Quoted 5 lines

fs/binfmt_elf.c +0 -1

 cleanup:
 	kfree(elf);
-	free_note_info(&info);
 	return has_dumped;
 }

Looks like fill_note_info() requires that you call free_note_info() if it fails; otherwise we'll leak memory. So perhaps something like the following totally untested patch?

Hi, Pekka!

Thanks for your comments. Yes, it seems that fill_note_info() is ugly. :-) How about the below one?

Signed-off-by WANG Cong <[email protected]>

---

fs/binfmt_elf.c +1 -1

index f6d5a9d..357b503 100644
@@ -1900,7 +1900,7 @@ static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file, un
 	/* alloc memory for large data structures: too large to be on stack */
 	elf = kmalloc(sizeof(*elf), GFP_KERNEL);
 	if (!elf)
-		goto cleanup;
+		goto ret;
 
 	segs = current->mm->map_count;
 #ifdef ELF_CORE_EXTRA_PHDRS

Looks good although 'ret' is usually reserved for the variable that contains the return value so you might want to consider using the more idiomatic 'out' as the label name.