fix more leaks in audit_tree.c tag_chunk()

Several leaks in audit_tree didn't get caught by commit
318b6d3d7ddbcad3d6867e630711b8a705d873d7, including the leak on normal
exit in case of multiple rules refering to the same chunk.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 6 insertions, 3 deletions

diff --git a/kernel/audit_tree.c b/kernel/audit_tree.c
index b36aa9651ba..4b05bd9479d 100644
--- a/kernel/audit_tree.c
+++ b/kernel/audit_tree.c
@@ -373,15 +373,17 @@ static int tag_chunk(struct inode *inode, struct audit_tree *tree)
         for (n = 0; n < old->count; n++) {
                 if (old->owners[n].owner == tree) {
                         spin_unlock(&hash_lock);
-                        put_inotify_watch(watch);
+                        put_inotify_watch(&old->watch);
                         return 0;
                 }
         }
         spin_unlock(&hash_lock);
 
         chunk = alloc_chunk(old->count + 1);
-        if (!chunk)
+        if (!chunk) {
+                put_inotify_watch(&old->watch);
                 return -ENOMEM;
+        }
 
         mutex_lock(&inode->inotify_mutex);
         if (inotify_clone_watch(&old->watch, &chunk->watch) < 0) {
@@ -425,7 +427,8 @@ static int tag_chunk(struct inode *inode, struct audit_tree *tree)
         spin_unlock(&hash_lock);
         inotify_evict_watch(&old->watch);
         mutex_unlock(&inode->inotify_mutex);
-        put_inotify_watch(&old->watch);
+        put_inotify_watch(&old->watch); /* pair to inotify_find_watch */
+        put_inotify_watch(&old->watch); /* and kill it */
         return 0;
 }