Commit 4294a8ee authored by André Goddard Rosa's avatar André Goddard Rosa Committed by Al Viro
Browse files

mqueue: fix mq_open() file descriptor leak on user-space processes 



We leak fd on lookup_one_len() failure

Signed-off-by: default avatarAndré Goddard Rosa <andre.goddard@gmail.com>
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent 4919c5e4

ipc/mqueue.c

+1 −2
Original line number Diff line number Diff line
@@ -705,7 +705,7 @@ SYSCALL_DEFINE4(mq_open, const char __user *, u_name, int, oflag, mode_t, mode, 
	dentry = lookup_one_len(name, ipc_ns->mq_mnt->mnt_root, strlen(name));

	if (IS_ERR(dentry)) {

		error = PTR_ERR(dentry);

		goto out_err;

		goto out_putfd;

	}

	mntget(ipc_ns->mq_mnt);
@@ -742,7 +742,6 @@ SYSCALL_DEFINE4(mq_open, const char __user *, u_name, int, oflag, mode_t, mode, 
	mntput(ipc_ns->mq_mnt);

out_putfd:

	put_unused_fd(fd);

out_err:

	fd = error;

out_upsem:

	mutex_unlock(&ipc_ns->mq_mnt->mnt_root->d_inode->i_mutex);