Unverified Commit fdfe0133 authored by Al Viro's avatar Al Viro Committed by Christian Brauner
Browse files

fix a leak in fcntl_dirnotify() 



[into #fixes, unless somebody objects]

Lifetime of new_dn_mark is controlled by that of its ->fsn_mark,
pointed to by new_fsn_mark.  Unfortunately, a failure exit had
been inserted between the allocation of new_dn_mark and the
call of fsnotify_init_mark(), ending up with a leak.

Fixes: 1934b212 "file: reclaim 24 bytes from f_owner"
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
Link: https://lore.kernel.org/20250712171843.GB1880847@ZenIV


Signed-off-by: default avatarChristian Brauner <brauner@kernel.org>
parent 177bb4cb

fs/notify/dnotify/dnotify.c

+4 −4
Original line number Diff line number Diff line
@@ -308,6 +308,10 @@ int fcntl_dirnotify(int fd, struct file *filp, unsigned int arg) 
		goto out_err;

	}



	error = file_f_owner_allocate(filp);

	if (error)

		goto out_err;



	/* new fsnotify mark, we expect most fcntl calls to add a new mark */

	new_dn_mark = kmem_cache_alloc(dnotify_mark_cache, GFP_KERNEL);

	if (!new_dn_mark) {
@@ -315,10 +319,6 @@ int fcntl_dirnotify(int fd, struct file *filp, unsigned int arg) 
		goto out_err;

	}



	error = file_f_owner_allocate(filp);

	if (error)

		goto out_err;



	/* set up the new_fsn_mark and new_dn_mark */

	new_fsn_mark = &new_dn_mark->fsn_mark;

	fsnotify_init_mark(new_fsn_mark, dnotify_group);