aboutsummaryrefslogtreecommitdiffstats
path: root/fs/pipe.c
diff options
context:
space:
mode:
authorOleg Nesterov <oleg@redhat.com>2009-03-12 17:31:28 -0400
committerLinus Torvalds <torvalds@linux-foundation.org>2009-03-12 19:20:23 -0400
commite5bc49ba7439b9726006d031d440cba96819f0f8 (patch)
tree103c02a297e4c7ba3ba1fd3c90a6bd2d6687f511 /fs/pipe.c
parent8d0df7a3d1ecbaf5d5602a59055c8ca993855bed (diff)
pipe_rdwr_fasync: fix the error handling to prevent the leak/crash
If the second fasync_helper() fails, pipe_rdwr_fasync() returns the error but leaves the file on ->fasync_readers. This was always wrong, but since 233e70f4228e78eb2f80dc6650f65d3ae3dbf17c "saner FASYNC handling on file close" we have the new problem. Because in this case setfl() doesn't set FASYNC bit, __fput() will not do ->fasync(0), and we leak fasync_struct with ->fa_file pointing to the freed file. Signed-off-by: Oleg Nesterov <oleg@redhat.com> Cc: Al Viro <viro@ZenIV.linux.org.uk> Cc: Andi Kleen <andi@firstfloor.org> Cc: Jonathan Corbet <corbet@lwn.net> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'fs/pipe.c')
-rw-r--r--fs/pipe.c8
1 files changed, 4 insertions, 4 deletions
diff --git a/fs/pipe.c b/fs/pipe.c
index 3a48ba5179d5..14f502b89cf5 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -699,12 +699,12 @@ pipe_rdwr_fasync(int fd, struct file *filp, int on)
699 int retval; 699 int retval;
700 700
701 mutex_lock(&inode->i_mutex); 701 mutex_lock(&inode->i_mutex);
702
703 retval = fasync_helper(fd, filp, on, &pipe->fasync_readers); 702 retval = fasync_helper(fd, filp, on, &pipe->fasync_readers);
704 703 if (retval >= 0) {
705 if (retval >= 0)
706 retval = fasync_helper(fd, filp, on, &pipe->fasync_writers); 704 retval = fasync_helper(fd, filp, on, &pipe->fasync_writers);
707 705 if (retval < 0) /* this can happen only if on == T */
706 fasync_helper(-1, filp, 0, &pipe->fasync_readers);
707 }
708 mutex_unlock(&inode->i_mutex); 708 mutex_unlock(&inode->i_mutex);
709 709
710 if (retval < 0) 710 if (retval < 0)