diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2008-04-22 19:51:27 -0400 |
|---|---|---|
| committer | Al Viro <viro@zeniv.linux.org.uk> | 2008-04-22 19:54:57 -0400 |
| commit | ed1524371716466e9c762808b02601d0d0276a92 (patch) | |
| tree | 73a9f836f54164f70649a318fe775638c79417b8 /fs/pipe.c | |
| parent | 521b5d0c40386f4a9805cdec7bd979fc96a86aeb (diff) | |
| download | linux-stable-ed1524371716466e9c762808b02601d0d0276a92.tar.gz linux-stable-ed1524371716466e9c762808b02601d0d0276a92.tar.bz2 linux-stable-ed1524371716466e9c762808b02601d0d0276a92.zip | |
[PATCH] double-free of inode on alloc_file() failure exit in create_write_pipe()
Duh... Fortunately, the bug is quite recent (post-2.6.25) and, embarrassingly,
mine ;-/
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'fs/pipe.c')
| -rw-r--r-- | fs/pipe.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/fs/pipe.c b/fs/pipe.c index 8be381bbcb54..f73492b6817e 100644 --- a/fs/pipe.c +++ b/fs/pipe.c @@ -988,7 +988,10 @@ struct file *create_write_pipe(void) return f; err_dentry: + free_pipe_info(inode); dput(dentry); + return ERR_PTR(err); + err_inode: free_pipe_info(inode); iput(inode); |