summaryrefslogtreecommitdiffstats
path: root/fs/fuse
diff options
context:
space:
mode:
authorMiklos Szeredi <miklos@szeredi.hu>2015-11-10 10:32:36 +0100
committerMiklos Szeredi <miklos@szeredi.hu>2015-11-10 10:32:36 +0100
commit2c5816b4beccc8ba709144539f6fdd764f8fa49c (patch)
treeb75771d8f86aa341ebdb6af7944380eadf3b6973 /fs/fuse
parent6a13feb9c82803e2b815eca72fa7a9f5561d7861 (diff)
downloadlinux-stable-2c5816b4beccc8ba709144539f6fdd764f8fa49c.tar.gz
linux-stable-2c5816b4beccc8ba709144539f6fdd764f8fa49c.tar.bz2
linux-stable-2c5816b4beccc8ba709144539f6fdd764f8fa49c.zip
cuse: fix memory leak
The problem is that fuse_dev_alloc() acquires an extra reference to cc.fc, and the original ref count is never dropped. Reported-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Miklos Szeredi <miklos@szeredi.hu> Fixes: cc080e9e9be1 ("fuse: introduce per-instance fuse_dev structure") Cc: <stable@vger.kernel.org> # v4.2+
Diffstat (limited to 'fs/fuse')
-rw-r--r--fs/fuse/cuse.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/fs/fuse/cuse.c b/fs/fuse/cuse.c
index eae2c11268bc..8e3ee1936c7e 100644
--- a/fs/fuse/cuse.c
+++ b/fs/fuse/cuse.c
@@ -549,6 +549,8 @@ static int cuse_channel_release(struct inode *inode, struct file *file)
unregister_chrdev_region(cc->cdev->dev, 1);
cdev_del(cc->cdev);
}
+ /* Base reference is now owned by "fud" */
+ fuse_conn_put(&cc->fc);
rc = fuse_dev_release(inode, file); /* puts the base reference */